Detecting DNS fast-flux anomalies
AssigneeNarus, Inc.
InventorSupranamaya Ranjan
Life of this patent
Estimating the term…
Abstract
A method for detecting automatically generated malicious domain names in a network. The method includes identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute, analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries, analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set of domain names, and generating an alert based on the distribution metric according to a pre-determined criterion.
Claims16
A method for detecting automatically generated malicious domain names in a network, comprising:
- identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;
- analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries;
- analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set domain names;
- and
- generating an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.
A system for detecting automatically generated malicious domain names in a network, comprising:
- a detecting program configured to capture a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;
- an analyzer program configured to:
- analyze the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries;
- and
- analyze the plurality of alphanumeric elements to determine a distribution metric of the set of domain names;
- and
- a processor and memory storing instructions when executed by the processor comprising functionality to:
- compare the distribution metric and a pre-determined threshold to generate a result;
- and
- generate an alert of domain fluxing based on the distribution metric according to a predetermined criterion.
A non-transitory computer readable medium storing instructions for detecting automatically generated malicious domain names network in a network, the instructions when executed by a processor of a computer comprising functionality to:
- identify a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;
- analyze the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries;
- analyze the plurality of alphanumeric elements to determine a distribution metric of the set of domain names;
- and
- generate an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.
Dependencies are inferred from the claim text.