System and method for detecting a DGA domain generation algorithm

System for detecting a domain generation algorithm (DGA) in a computer communication network comprising at least one domain name system (DNS) request resolution server for resolving DNS requests from at least one client terminal, characterized in that the computer communication network further comprises:

• a hardware-based detection device coupled to the resolution server and comprising data processing means configured, for each DNS request, to associate the requested domain name and the identity of the requesting client terminal to form a tuple;
• to combine in homogeneous partitions the tuples thus combined according to the community detection technique;
• and to deduce for each homogeneous partition all the client terminals using a same DGA;
• and
• a hardware-based processor for measuring a quality of clustering according to a calculation of a modularity of the tuples in detected communities,
• wherein the community detection technique is carried out from a first bipartite graph comprising:
• a) a plurality of client terminal nodes;
• b) a plurality of domain nodes;
• c) a plurality of edges each representing a DNS query from a first client terminal node to a first domain node, the first domain node being connectable to multiple client terminal nodes, and the first client terminal node being connectable to multiple domain nodes;
• and
• d) the community detection of tuples in the bipartite graph being capable of generating distinct partitions distributed in at least a second bipartite graph including tuples representing a coherent set of client terminals making DNS queries on a set of domains.

A non-transient computer-readable medium having program instructions executed on a computer for the detection of a domain generation algorithm (DGA) in a computer communication network comprising at least one resolution server for resolving domain name system (DNS) requests emanating from at least one client terminal, characterized in that the computer communication network further comprises a detection module coupled to the resolution server and configured to analyse analyze the DNS requests according to the following steps:

• for each DNS request, associate the requested domain name and the identity of the requesting client terminal to form a tuple;
• combine the tuples into homogeneous partitions according to a community detection technique;
• and
• deduce for each homogeneous partition all the client terminals using the same DGA;
• and
• measure a quality of clustering according to a calculation of a modularity of the tuples in detected communities,
• wherein the community detection technique is carried out from a first bipartite graph comprising:
• a) a plurality of client terminal nodes;
• b) a plurality of domain nodes;
• c) a plurality of edges each representing a DNS query from a first client terminal node to a first domain node, the first domain node being connectable to multiple client terminal nodes, and the first client terminal node being connectable to multiple domain nodes;
• and
• d) the community detection of tuples in the bipartite graph being capable of generating distinct partitions distributed in at least a second bipartite graph including tuples representing a coherent set of client terminals making DNS queries on a set of domains.