US 12,225,029 B2Granted

Automatic identification of algorithmically generated domain families

AssigneeIronNet Cybersecurity, Inc.

InventorsNicholas Todd Smith, Peter Adelman

Life of this patent

Estimating the term…

Loading patent…

Abstract

According to the present disclosure, network security systems (e.g., network security algorithms) may uniquely identify an underlying algorithm and configuration used to produce domain names. For instance, network security techniques described herein may consider a collection of fully-qualified domain names (FQDNs) (e.g., taken from related network traffic data) and produce a value that can serve to uniquely identify the underlying generating algorithm and configuration used to produce the collection of FQDNs. In some examples, such may include implementation of statistical techniques to capture characteristic information about the amount of randomness, length, and distribution of characters in the collection of FQDNs. In some aspects, values of the characteristic information are adjusted based on a determined set of precision parameters. In some aspects, a single value may be produced, which can then be stored for later use in comparing with other values produced from some subsequent collection of FQDNs.

Claims21

Dependent claims

A method of signaling a detecting of automatic identification of algorithmically generated domain names comprising:

collecting a first plurality of fully-qualified domain names from first related network traffic via a computer network;
generating a fingerprint indicative of a generation algorithm, wherein the fingerprint is generated as a function of length, randomness, and character distribution of the first plurality of fully-qualified domain names and utilizing a set of precision parameters, wherein said generating of said fingerprint comprises steps of:
determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the first plurality of fully-qualified domain names;
determining a digit character ratio comprising ((nc−nd)/(nc+nd)+1)/2, wherein nc is the number of digit characters, and nd is the number of non-digit characters;
determining an entropy over all domains of the first plurality of fully-qualified domain names, and dividing the entropy over all domains of the first plurality of fully-qualified domain names by a maximum possible entropy achievable;
determining an average domain name length of said first plurality of fully-qualified domain names;
determining an average domain name log-length by determining log 10(1+the average domain name length of said first plurality of fully-qualified domain names);
and
rounding the digit character ratio, the entropy, and the average domain name log-length according to the set of precision parameters;
storing the fingerprint in a database and associating the fingerprint with the first related network traffic;
detecting a second plurality of fully-qualified domain names from second related network traffic via the computer network;
detecting whether the fingerprint correlates to a value generated as a function of length, randomness, and character distribution of the second plurality of fully-qualified domain names and utilizing the set of precision parameters;
signaling when the fingerprint correlates to the value.

10 more elements

A system for signaling a detecting of automatic identification of algorithmically generated domain names comprising:

a database storing a fingerprint and associating the fingerprint with first related network traffic from a computer network;
a computer network interface coupled to a plurality of fully-qualified domain names from second related network traffic on the computer network;
and
a processor coupled to the computer network interface and comprising a code segment for performing the following steps:
detecting whether the fingerprint correlates to a value generated as a function of length, randomness, and character distribution of the plurality of fully-qualified domain names and utilizing a set of precision parameters;
and
signaling when the fingerprint correlates to the value, wherein the system further comprises:
another computer network interface coupled to another plurality of fully-qualified domain names from the first related network traffic on the computer network;
another processor coupled to the other computer network interface and comprising another code segment for performing the following step:
generating the fingerprint indicative of a generation algorithm, wherein the fingerprint is generated as a function of length, randomness, and character distribution of the other plurality of fully-qualified domain names and utilizing the set of precision parameters, wherein the generating the fingerprints comprises the steps of:
determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the other plurality of fully-qualified domain names;
determining a digit character ratio comprising ((nc−nd)/(nc+nd)+1)/2, wherein nc is the number of digit characters, and nd is the number of non-digit characters;
determining an entropy over all domains of the other plurality of fully-qualified domain names, and dividing the entropy over all domains of the other plurality of fully-qualified domain names by a maximum possible entropy achievable;
determining an average domain name length of said other plurality of fully-qualified domain names;
determining an average domain name log-length by determining log 10(1+the average domain name length of said other plurality of fully-qualified domain names);
and
rounding the digit character ratio, the entropy, and the average domain name log-length according to the set of precision parameters.

14 more elements

A method of signaling a detecting of automatic identification of algorithmically generated domain names comprising:

detecting a plurality of fully-qualified domain names from related network traffic via a computer network;
detecting whether a fingerprint correlates to a value generated as a function of length, randomness, and character distribution of the plurality of fully-qualified domain names and utilizing a set of precision parameters;
signaling when the fingerprint correlates to the value, wherein the method further comprises:
collecting another plurality of fully-qualified domain names from another related network traffic via the computer network;
generating the fingerprint indicative of a generation algorithm, wherein the fingerprint is generated as a function of length, randomness, and character distribution of the other plurality of fully-qualified domain names and utilizing the set of precision parameters, wherein said generating of said fingerprint comprises steps of:
determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the other plurality of fully-qualified domain names;
determining a digit character ratio comprising ((nε-nd)/(nc+nd)+1)/2, wherein nc is the number of digit characters, and nd is the number of non-digit characters;
determining an entropy over all domains of the other plurality of fully-qualified domain names, and dividing the entropy over all domains of the other plurality of fully-qualified domain names by a maximum possible entropy achievable;
determining an average domain name length of said other plurality of fully-qualified domain names;
determining an average domain name log-length by determining log 10(1+the average domain name length of said other plurality of fully-qualified domain names);
and
rounding the digit character ratio, the entropy, and the average domain name log-length according to the set of precision parameters;
and
storing the fingerprint in a database and associating the fingerprint with the related network traffic.

11 more elements

A method of signaling a detecting of automatic identification of algorithmically generated domain names comprising:

collecting a first plurality of fully-qualified domain names from first related network traffic via a computer network;
generating a fingerprint indicative of a generation algorithm, wherein the fingerprint is generated as a function of length, randomness, and character distribution of the first plurality of fully-qualified domain names and utilizing a set of precision parameters, wherein said generating of said fingerprint comprises steps of:
determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the first plurality of fully-qualified domain names;
determining a digit character ratio comprising ((nc−nd)/(nc+nd)+1)/2, wherein nc is the number of digit characters, and nd is the number of non-digit characters;
determining an entropy over all domains of the first plurality of fully-qualified domain names, and dividing the entropy over all domains of the first plurality of fully-qualified domain names by a maximum possible entropy achievable;
determining an average domain name length of said first plurality of fully-qualified domain names;
determining an average domain name log-length by determining log 10(1+the average domain name length of said first plurality of fully-qualified domain names);
and
rounding the digit character ratio, the entropy, and the average domain name log-length according to the set of precision parameters;
storing the fingerprint in a database and associating the fingerprint with the first related network traffic.

7 more elements

Dependencies are inferred from the claim text.