Filtering onion routing traffic from malicious domain generation algorithm (DGA)-based traffic classification

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive domain information from a plurality of traffic flows in the network;
• identify a particular address from the plurality of traffic flows as part of an onion routing system based on the received domain information, wherein the apparatus identifies the particular address as part of an onion routing system based on the received domain information by:
• determining character counts for each character that appear in domain names associated with the particular address in the received domain information;
• and
• determining a statistical distance between the character counts and a uniform distribution of character counts;
• and
• comparing the statistical distance to a threshold value, to determine whether the particular address is part of an onion routing system;
• distinguish the particular address during analysis of the traffic flows by a traffic flow analyzer that includes a domain generation algorithm (DGA)-based traffic classifier;
• detect a malicious traffic flow from among the plurality of traffic flows using the traffic flow analyzer;
• and
• cause performance of a mitigation action based on the detected malicious traffic flow.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• receiving, at the device, domain information from a plurality of traffic flows in the network;
• identifying, by the device, a particular address from the plurality of traffic flows as part of an onion routing system based on the received domain information, wherein identifying the particular address as part of an onion routing system based on the received domain information comprises:
• determining, by the device, character counts for each character that appear in domain names associated with the particular address in the received domain information,
• determining, by the device, a statistical distance between the character counts and a uniform distribution of character counts, and
• comparing, by the device, the statistical distance to a threshold value, to determine whether the particular address is part of an onion routing system;
• distinguishing, by the device, the particular address during analysis of the traffic flows by a traffic flow analyzer that includes a domain generation algorithm (DGA)-based traffic classifier;
• detecting, by the device, a malicious traffic flow from among the plurality of traffic flows using the traffic flow analyzer;
• and
• causing, by the device, performance of a mitigation action based on the detected malicious traffic flow.