US 9,426,168 B1Granted

Fast-flux detection utilizing domain name system information

AssigneeEMC Corporation

InventorsEyal Yehowa Gruss, Ereli Eran, Alex Vaystikh, Eyal Kolman, Alon Kaufman

Life of this patent

Estimating the term…

Loading patent…

Abstract

A processing device comprises a processor coupled to a memory and is configured to determine a first set of features from domain name system (DNS) information, the first set of features being defined over a domain, and to determine a second set of features from the DNS information, the second set of features being defined over internet protocol (IP) addresses returned for the domain. The processing device is further configured to compute a fast-flux score based on the first and second sets of features, and to utilize the fast-flux score to characterize fast-flux activity relating to the domain. For example, the processing device can be configured to compare the fast-flux score to a threshold, and to generate an indicator of the presence or absence of fast-flux activity based on a result of the comparison. The processing device may be implemented in a computer network or network security system.

Claims20

Dependent claims

A method comprising steps of:

determining a first set of features from domain name system (DNS) information stored in at least one database of a computer network, the first set of features being defined over a domain accessed by a plurality of network devices of the computer network;
determining a second set of features from the DNS information, the second set of features being defined over internet protocol (IP) addresses returned for the domain;
computing a fast-flux score based on the first and second sets of features;
utilizing the fast-flux score to characterize fast-flux activity relating to the domain;
and
generating a fast-flux activity indicator in a network security system of the computer network in conjunction with the characterization of fast-flux activity relating to the domain;
wherein at least a portion of the first set of features is based on a number of distinct date-based pairs with each such pair comprising one of an IP address and an autonomous system number and an associated date;
wherein at least a portion of the second set of features is based on a number of distinct roots associated with one of an IP address and an autonomous system number;
and
wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.

7 more elements

An article of manufacture comprising a processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:

to determine a first set of features from domain name system (DNS) information stored in at least one database of a computer network, the first set of features being defined over a domain accessed by a plurality of network devices of the computer network;
to determine a second set of features from the DNS information, the second set of features being defined over internet protocol (IP) addresses returned for the domain;
to compute a fast-flux score based on the first and second sets of features;
to utilize the fast-flux score to characterize fast-flux activity relating to the domain;
and
to generate a fast-flux activity indicator in a network security system of the computer network in conjunction with the characterization of fast-flux activity relating to the domain;
wherein at least a portion of the first set of features is based on a number of distinct date-based pairs with each such pair comprising one of an IP address and an autonomous system number and an associated date;
and
wherein at least a portion of the second set of features is based on a number of distinct roots associated with one of an IP address and an autonomous system number.

6 more elements

Dependencies are inferred from the claim text.