Identifying algorithmically generated domains
AssigneeHewlett Packard Enterprise Development LP
InventorsJosiah Hagen, Brandon Niemczyk, Richard Lawshae
Life of this patent
Estimating the term…
Abstract
Examples relate to identifying algorithmically generated domains. In one example, a computing device may: receive a query domain name; provide the query domain name as input to a predictive model that has been trained to determine whether the query domain name is an algorithmically generated domain name, the determination being based on syntactic features of the query domain name, the syntactic features including a count of particular character n-grams included in at least a portion of the query domain name, where n is a positive integer greater than one; and receive, as output from the predictive model, data indicating whether the query domain name is algorithmically generated.
Claims15
A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for identifying algorithmically generated domains, the machine-readable storage medium comprising instructions to cause the hardware processor to:
- receive a first set of domain names, each domain name in the first set being a domain name that was previously identified as valid;
- receive a second set of domain names, each domain name in the second set being a domain name that was previously identified as algorithmically generated;
- and
- train, using the first set and second set, a predictive model to identify a given domain name as one of a valid domain name or an algorithmically generated domain name based on a plurality of syntactic features, the plurality of syntactic features including a count of particular character n-grams included in at least a portion of the query domain name, where n is a positive integer greater than one.
A computing device for identifying algorithmically generated domains, the computing device comprising:
- a hardware processor;
- and
- a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to:
- receive a query domain name;
- provide the query domain name as input to a predictive model that has been trained to determine whether the query domain name is an algorithmically generated domain name, the determination being based on syntactic features of the query domain name, the syntactic features including a count of particular character n-grams included in at least a portion of the query domain name, where n is a positive integer greater than one;
- and
- receive, as output from the predictive model, data indicating whether the query domain name is algorithmically generated.
A method for identifying algorithmically generated domains, implemented by a hardware processor, the method comprising:
- receiving, from a client device, a domain name system (DNS) query packet, the DNS query packet including a query domain name;
- determining whether the query domain name is an algorithmically generated domain name, the determination being based on syntactic features of the query domain name, the syntactic features including a count of particular character n-grams included in at least a portion of the query domain name, where n is a positive integer greater than one;
- and
- providing output indicating whether the query domain name is algorithmically generated.
Dependencies are inferred from the claim text.