Query Classification for Detecting DGA Botnet Communications

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing solutions struggle to detect malicious network activity, particularly from botnets, as they rely on known signatures and fail to identify 'unknown unknowns' generated by Domain Generation Algorithms (DGAs), which appear legitimate and evade detection.

Innovation Solution

An intermediary system uses machine learning to analyze and classify entity identifier queries based on features such as contiguous sequences of characters, rankings in dictionaries, and IP addresses, identifying illegitimate queries generated by DGAs to prevent communication with command and control devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If signature detection methods are used to identify malicious network activity, then detection accuracy for known threats is improved, but the ability to detect unknown threats generated by Domain Generation Algorithms deteriorates

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect unknown threats

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic analysis by extracting features from the behavior and characteristics of entity identifier queries rather than relying on static signatures. The system continuously monitors query patterns, timing, and structural features to adaptively identify malicious activity, allowing it to detect both known and unknown threats generated by Domain Generation Algorithms.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system transforms the detection approach by changing from signature-based parameters to feature-based parameters such as query timing, structural characteristics, and behavioral patterns. This parameter transformation enables the detection system to identify malicious queries through their distinctive features rather than requiring pre-known signatures, thereby improving detection of unknown threats.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If machine learning models are trained on known malicious patterns, then classification accuracy for known threats is improved, but detection of novel malicious patterns deteriorates

Engineering Contradiction:

Improveclassification accuracyVSAvoiddetection of novel patterns

Core Design Contradiction:

Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The system performs preliminary feature extraction and analysis on entity identifier queries before final classification. By pre-processing queries to extract meaningful features such as timing patterns, structural characteristics, and behavioral indicators, the system prepares data in a form that enables both accurate classification of known threats and effective detection of novel patterns through the trained machine learning model.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary feature extraction layer between the raw queries and the machine learning classifier. This intermediary component transforms raw query data into meaningful features that bridge the gap between known patterns in training data and novel patterns in production, enabling the classifier to generalize effectively to unseen threats while maintaining high accuracy on known threats.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Object-generated harmful factors

If traditional anomaly detection is applied to network traffic, then detection of obvious malicious activity is improved, but identification of sophisticated botnet communication deteriorates

Engineering Contradiction:

Improvedetection of malicious activityVSAvoididentification of botnet communication

Core Design Contradiction:

Object-generated harmful factorsVSReliability

Solution Approach 1:

The patent segments the analysis of entity identifier queries into multiple distinct feature dimensions including timing characteristics, structural features, and behavioral patterns. By dividing the detection task into these segmented feature analyses rather than treating traffic as a monolithic stream, the system can reliably identify sophisticated botnet communication through multiple independent indicators rather than relying on single obvious anomalies.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system implements a universal detection framework that analyzes multiple aspects of entity identifier queries simultaneously using the same machine learning model. This multi-functional approach enables the system to detect various types of malicious activity including botnet communication, DGA-generated domains, and other threats through a unified analysis mechanism, improving reliability across different threat types.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12476982B2Methods, systems, and apparatuses for query analysis and classification

Publication Date: 2025.11.18 COMCAST CABLE COMM LLC

AI summary

Described herein are methods, systems, and apparatuses for query analysis and classification. A plurality of entity identifier queries associated with a plurality of entity identifiers may be received and classified as being legitimate or illegitimate. Illegitimate entity identifier queries may be associated with originating devices that are infected with malware. The originating devices may have sent the illegitimate entity identifier queries in an attempt to communicate with a command and control server(s) of a botnet. Such originating devices may be identified and one or more remedial actions may be performed.