Back to results
US 12,041,076 B2Granted
Detecting visual similarity between DNS fully qualified domain names
AssigneeInfoblox Inc.
InventorVadym Tymchenko
Life of this patent
Estimating the term…
Abstract
Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.
Claims12
A system, comprising:
- a processor;
- and
- a memory coupled to the processor and configured to provide the processor with instructions when executed by the processor cause the processor to:
- receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- perform extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising to:
- receive a candidate FQDN and a target FQDN;
- construct a cost table and a dynamic table, wherein the cost table and the dynamic table both have costs;
- and
- trace back from the end of the dynamic table to recover a set of operations to transform the target FQDN into the candidate FQDN, wherein the set of operations is associated with a minimal cost;
- classify the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- perform a mitigation action based on the classifying and detecting the malware FQDNS, wherein the performing of the mitigation action comprises
- perform one or more of following:
- block the DNS response to impede a client communication with an IP address associated with the malware FQDNs;
- add the IP address associated with the malware FQDNs to a blacklist or to a blacklist feed;
- send the IP address associated with the malware FQDNs to a firewall;
- generate a firewall rule based on an IP address associated with a first malware FQDN;
- configure a network device to block network communications with the IP address associated with the first malware FQDN;
- quarantine an infected host, wherein the infected host is determined to be infected based on an association with the IP address associated with the first malware FQDN;
- or
- add the first malware FQDN to a reputation feed.
18 more elements
A method, comprising:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising:
- receiving a candidate FQDN and a target FQDN;
- constructing a cost table and a dynamic table, wherein the cost table and the dynamic table both have costs;
- and
- tracing back from the end of the dynamic table to recover a set of operations to transform the target FQDN into the candidate FQDN, wherein the set of operations is associated with a minimal cost;
- classifying the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- performing a mitigation action based on the classifying and detecting the malware FQDNS, wherein the performing of the mitigation action comprises
- performing one or more of following:
- blocking the DNS response to impede a client communication with an IP address associated with the malware FQDNs;
- adding the IP address associated with the malware FQDNs to a blacklist or to a blacklist feed;
- sending the IP address associated with the malware FQDNs to a firewall;
- generating a firewall rule based on an IP address associated with a first malware FQDN;
- configuring a network device to block network communications with the IP address associated with the first malware FQDN;
- quarantining an infected host, wherein the infected host is determined to be infected based on an association with the IP address associated with the first malware FQDN;
- or
- adding the first malware FQDN to a reputation feed.
15 more elements
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising:
- receiving a candidate FQDN and a target FQDN;
- constructing a cost table and a dynamic table, wherein the cost table and the dynamic table both have costs;
- and
- tracing back from the end of the dynamic table to recover a set of operations to transform the target FQDN into the candidate FQDN, wherein the set of operations is associated with a minimal cost;
- and
- classifying the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- performing a mitigation action based on the classifying and detecting the malware FQDNS, wherein the performing of the mitigation action comprises
- performing one or more of following:
- blocking the DNS response to impede a client communication with an IP address associated with the malware FQDNs;
- adding the IP address associated with the malware FQDNs to a blacklist or to a blacklist feed;
- sending the IP address associated with the malware FQDNs to a firewall;
- generating a firewall rule based on an IP address associated with a first malware FQDN;
- configuring a network device to block network communications with the IP address associated with the first malware FQDN;
- quarantining an infected host, wherein the infected host is determined to be infected based on an association with the IP address associated with the first malware FQDN;
- or
- adding the first malware FQDN to a reputation feed.
16 more elements
Dependencies are inferred from the claim text.