System and method for detection of domain-flux botnets and the like

A computer-implemented method for detecting malicious software agents, the method comprising:

• (a) constructing a graph based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period;
• (b) deriving, from the graph, one or more candidate clusters of hosts, wherein step (b) comprises:
• (b1) generating multi-level hierarchical groupings of Internet Protocol (IP) addresses in the graph based on similarities between at least first and second levels of domain names in failed domain-name queries made by hosts corresponding to the IP addresses;
• (b2) determining, for each hierarchical grouping, a highest percentage of failed domain-name queries for which a most recently added IP address in the hierarchical grouping has at least first and second levels of domain names in common with another IP address in the hierarchical grouping;
• and
• (b3) identifying each highest-level hierarchical grouping having its determined percentage more than a specified percentage threshold as a candidate cluster of hosts;
• and
• (c) determining that one or more of the candidate clusters correspond to malicious software agents.

A computer-implemented method for detecting malicious software agents, the method comprising:

• (a) constructing a graph based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period;
• (b) deriving, from the graph, one or more candidate clusters of hosts for each of a plurality of time intervals in the time period;
• (c) linking candidate clusters in adjacent time intervals based on shared IP addresses to form one or more cluster chains;
• (d) identifying one or more cluster chains that are longer than a specified length threshold;
• and
• (e) determining that one or more of the identified cluster chains correspond to malicious software agents.

Apparatus for detecting malicious software agents, comprising:

• a query pre-processor adapted to construct a graph based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period;
• a malicious software agent detector adapted to:
• (i) derive, from the graph, one or more candidate clusters of hosts;
• (ii) determine, for each candidate cluster and for each of a plurality of time intervals during the time period, a number of new domain names appearing in the failed queries of the candidate cluster during the time interval;
• and
• (iii) determine, for each candidate cluster, a freshness metric based on the numbers of new domain names for the plurality of time intervals in the time period;
• and
• a malicious software agent server tracker adapted to detect one or more malicious software agents on the hosts based on the one or more freshness metrics.

Apparatus for detecting malicious software agents, comprising:

• a query pre-processor adapted to construct a graph based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period;
• a malicious software agent detector adapted to derive, from the graph, one or more candidate clusters of hosts, wherein the deriving comprises:
• (i) generating multi-level hierarchical groupings of Internet Protocol (IP) addresses in the graph based on similarities between at least first and second levels of domain names in failed domain-name queries made by hosts corresponding to the IP addresses;
• (ii) determining, for each hierarchical grouping, a highest percentage of failed domain-name queries for which a most recently added IP address in the hierarchical grouping has at least first and second levels of domain names in common with another IP address in the hierarchical grouping;
• and
• (iii) identifying each highest-level hierarchical grouping having its determined percentage more than a specified percentage threshold as a candidate cluster of hosts;
• and
• a malicious software agent server tracker adapted to determine that one or more of the candidate clusters correspond to malicious software agents.

Apparatus for detecting malicious software agents, comprising:

• a query pre-processor adapted to construct a graph based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period;
• a malicious software agent detector adapted to:
• (i) derive, from the graph, one or more candidate clusters of hosts for each of a plurality of time intervals in the time period;
• (ii) link candidate clusters in adjacent time intervals based on shared IP addresses to form one or more cluster chains;
• and
• (iv) identify one or more cluster chains that are longer than a specified length threshold;
• and
• a malicious software agent server tracker adapted to determine that one or more of the identified cluster chains correspond to malicious software agents.