Indicating malware generated domain names using n-grams

A system comprising:

• a processor;
• and
• a non-transitory storage medium storing instructions executable on the processor to:
• receive a domain name system (DNS) message including a domain name;
• identify, in the domain name, n-grams that do not appear in words of a given language, where n is greater than two, and each n-gram of the identified n-grams that do not appear in the words of the given language includes a sequence of n letters;
• compute a domain name value by dividing a number of the identified n-grams that do not appear in the words of the given language by a total number of n-grams in the domain name;
• compare the domain name value based on a number of the identified n-grams that do not appear in the words of the given language to a threshold;
• indicate that the domain name is potentially generated by malware in response to the domain name value having a specified relationship with the threshold;
• determine, based on the indicating, whether a device value has a specified relationship with another threshold, wherein the device value is based on dividing a number of potentially malware produced DNS messages issued by a device within a time window by a total number of messages within the time window, and wherein each of the potentially malware produced DNS message includes a domain name indicated as potentially generated by malware;
• and
• identify the device as malware infected in response to determining that the value based on the number of potentially malware produced DNS messages issued by the device within the time window has the specified relationship with the another threshold.

A method executed by a system comprising a processor, comprising:

• receiving a message containing a domain name;
• determining whether the domain name is part of a whitelist of benign domain names;
• and
• in response to determining that the domain name is not part of the whitelist of benign domain names:
• identifying, in the domain name, n-grams that do not appear in words of a given language, where n is greater than two, and each n-gram of the identified n-grams that do not appear in the words of the given language includes a sequence of n letters;
• computing a domain name value by dividing the number of the identified n-grams that do not appear in the words of the given language by a total number of n-grams in the domain name;
• comparing the domain name value based on a number of the identified n-grams that do not appear in the words of the given language to a first threshold;
• in response to the domain name value having a specified relationship with the first threshold, associating a timestamp and a network address with the received message;
• determining, using the timestamp and the network address, whether a device value based exceeds a second threshold, wherein the device value is based on dividing a number of potentially malware produced messages within a time window by a total number of messages generated within the time window, and wherein the total number of messages within the time window includes the received message;
• and
• identifying a device as potentially infected with malware based on determining that the value based on the number of potentially malware produced messages within the time window exceeds the second threshold.