Back to results
US 11,695,789 B2Granted
Detection of algorithmically generated domains based on a dictionary
AssigneeInfoblox Inc.
InventorsMayana Pereira, Vadym Tymchenko, Bin Yu
Life of this patent
Estimating the term…
Abstract
Techniques for detection of algorithmically generated domains based on a dictionary are disclosed. In some embodiments, a system, process, and/or computer program product for detection of algorithmically generated domains based on a dictionary includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; generating a graph based on the DNS data stream; and identifying a malicious dictionary based on the graph.
Claims20
A system, comprising:
- a processor configured to:
- receive a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;
- detect DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:
- extracting a set of words from natural language related domains in the DNS data stream;
- splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain;
- and
- obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set;
- and
- perform a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
8 more elements
A method, comprising:
- receiving a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;
- detecting DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:
- extracting a set of words from natural language related domains in the DNS data stream;
- splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain;
- and
- obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set;
- and
- performing a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware.
5 more elements
A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- receiving a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;
- detecting DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:
- extracting a set of words from natural language related domains in the DNS data stream;
- splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain;
- and
- obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set;
- and
- performing a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware.
5 more elements
Dependencies are inferred from the claim text.