Detecting visual similarity between dns fully qualified domain names
AssigneeInfoblox Inc.
InventorVadym Tymchenko
Life of this patent
Estimating the term…
Abstract
Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.
Claims20
A system, comprising:
- a processor configured to:
- receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- perform extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream;
- and
- classify the set of FQDNs as malware FQDNs or benign FQDNs based on results of the extended sequence alignment;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream;
- and
- classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query, and wherein the DNS data stream includes a set of fully qualified domain names (FQDNs);
- performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream;
- and
- classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.
Dependencies are inferred from the claim text.