Methods and systems for identification of a domain of a command and control server of a botnet

#Embodiments of the invention relate to the field of network services; and more specifically to the identification of a domain of a command and control server of a botnet.

#A botnet is a number of computing devices coupled within a network and communicating with other computing devices in an effort to complete repetitive tasks and objectives. For example, a botnet can be used to keep control of an Internet Relay Chat (IRC) channel, to send spam email or to participate in distributed denial-of-service attacks. Generally, botnets are considered malicious and a threat to a network, which needs to be detected and neutralized. A command and control server is a centralized computing device that is able to send commands and receive responses from the other computing devices part of the botnet.

#Many botnets use a Domain Generation Algorithm (DGA) to identify the hostname of their command and control (C&C) servers. DGAs are algorithms used to periodically generate a large number of domain names that can be used as domains for command and control servers of botnet (or more generally for command and control servers of malware). The large number of potential command and control servers makes it difficult for law enforcement to effectively shut down botnets since infected computers will attempt to contact some of these domain names every day to receive updates or commands. The DGAs are generally deterministic algorithm, time-based and custom for each malware family.

#The invention may best be understood by referring to the following description and accompanying drawings that are used to illustrate embodiments of the invention. In the drawings:

#FIG. 1 illustrates an exemplary architecture of an Internet-based proxy service according to one embodiment of the invention;

#FIG. 2 is a flow diagram illustrating exemplary operations for identifying a command and control server according to one embodiment of the invention;

#In the following description, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In other instances, well-known circuits, structures and techniques have not been shown in detail in order not to obscure the understanding of this description. Those of ordinary skill in the art, with the included descriptions, will be able to implement appropriate functionality without undue experimentation.

#References in the specification to “one embodiment,” “an embodiment,” “an example embodiment,” etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

#Bracketed text and blocks with dashed borders (e.g., large dashes, small dashes, dot-dash, and dots) may be used herein to illustrate optional operations that add additional features to embodiments of the invention. However, such notation should not be taken to mean that these are the only options or optional operations, and/or that blocks with solid borders are not optional in certain embodiments of the invention.