System and method for detecting dictionary-based dga traffic
AssigneePalo Alto Networks, Inc.
InventorsJanos Szurdi, Weihan Jiang, David Qianshan He
Life of this patent
Estimating the term…
Abstract
A system and method for detecting dictionary-based DGA traffic is provided. A domain name system (DNS) stream is received. The DNS stream is classified using a per domain dictionary domain generation algorithm (DGA) classifier to generate candidate dictionary DGA domains with cluster information. The candidate dictionary DGA domains are filtered to generate a set of dictionary DGA domains. An action is performed based on a match with a monitored domain name of a monitored DNS request and a dictionary DGA domain of the set of dictionary DGA domains.
Claims20
A system, comprising:
- a processor configured to:
- receive a domain name system (DNS) stream, wherein the DNS stream includes a plurality of DNS requests;
- segment a domain name of one of the plurality of DNS requests into a set of words;
- extract features from the set of words to generate a set of dictionary DGA domains;
- and
- perform an action based on a match with a monitored domain name of a monitored DNS request and a dictionary DGA domain of the set of dictionary DGA domains;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving, using a processor, a domain name system (DNS) stream, wherein the DNS stream includes a plurality of DNS requests;
- segmenting, using the processor, a domain name of one of the plurality of DNS requests into a set of words;
- extracting, using the processor, features from the set of words to generate a set of dictionary DGA domains;
- and
- performing, using the processor, an action based on a match with a monitored domain name of a monitored DNS request and a dictionary DGA domain of the set of dictionary DGA domains.
A system, comprising:
- a processor configured to:
- receive a domain name system (DNS) stream, wherein the DNS stream includes a plurality of DNS requests;
- means for segmenting a domain name of one of the plurality of DNS requests into a set of words;
- means for extracting features from the set of words to generate a set of dictionary DGA domains;
- and
- perform an action based on a match with a monitored domain name of a monitored DNS request and a dictionary DGA domain of the set of dictionary DGA domains;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
Dependencies are inferred from the claim text.