Back to results
US 12,513,185 B2Granted
Detecting visual similarity between DNS fully qualified domain names
AssigneeInfoblox Inc.
InventorVadym Tymchenko
Life of this patent
Estimating the term…
Abstract
Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.
Claims17
A system, comprising:
- a processor;
- and
- a memory coupled to the processor and configured to provide the processor with instructions when executed by the processor cause the processor to:
- receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- prefilter the set of FQDNs for identifying potential malware FQDNs for one or more target FQDNs;
- perform extended sequence alignment for each of the set of FQDNs to identify the potential malware FQDNs for the one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising to:
- receive a candidate FQDN of the each of the set of FQDNs and a target FQDN of the one or more target FQDNs;
- construct a cost table and an operations table, wherein the cost table includes minimal costs for all incremental comparison of the candidate FQDN and the target FQDN, and wherein in each cell, the operations table stores encoding of a minimal cost operation that is allowed to reach a position;
- and
- determine a set of operations to transform the target FQDN into the candidate FQDN based on the cost table and the operations table, wherein the set of operations is associated with a minimal cost;
- classify the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- perform a mitigation action based on a detection of the malware FQDNs.
10 more elements
A method, comprising:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- prefiltering the set of FQDNs for identifying potential malware FQDNs for one or more target FQDNs;
- performing extended sequence alignment for each of the set of FQDNs to identify the potential malware FQDNs for the one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising:
- receiving a candidate FQDN of the each of the set of FQDNs and a target FQDN of the one or more target FQDNs;
- constructing a cost table and an operations table, wherein the cost table includes minimal costs for all incremental comparison of the candidate FQDN and the target FQDN, and wherein in each cell, the operations table stores encoding of a minimal cost operation that is allowed to reach a position;
- determining a set of operations to transform the target FQDN into the candidate FQDN based on the cost table and the operations table, wherein the set of operations is associated with a minimal cost;
- classifying the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- performing a mitigation action based on a detection of the malware FQDNs.
6 more elements
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- prefiltering the set of FQDNs for identifying potential malware FQDNs for one or more target FQDNs;
- performing extended sequence alignment for each of the set of FQDNs to identify the potential malware FQDNs for the one or more target FQDNs based on a visual similarity for each domain in the DNS data stream, comprising:
- receiving a candidate FQDN of the each of the set of FQDNs and a target FQDN of the one or more target FQDNs;
- constructing a cost table and an operations table, wherein the cost table includes minimal costs for all incremental comparison of the candidate FQDN and the target FQDN, and wherein in each cell, the operations table stores encoding of a minimal cost operation that is allowed to reach a position;
- determining a set of operations to transform the target FQDN into the candidate FQDN based on the cost table and the operations table, wherein the set of operations is associated with a minimal cost;
- classifying the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- performing a mitigation action based on a detection of the malware FQDNs.
6 more elements
Dependencies are inferred from the claim text.