DNS query analysis for detection of malicious software

A computer-readable storage, which is nonvolatile storage, including instructions thereon for executing a method of detecting that malicious software is present on host server computers, comprising:

• obtaining, using a monitoring server computer, Domain Name System (DNS) traffic data between a DNS server and a plurality of host server computers;
• correlating the DNS traffic data across the host server computers or virtual machines on the same host server computer for at least one common pattern of behavior of transmitting DNS requests that is independent of domain lookup;
• and
• for the correlated DNS traffic data that is independent of domain lookup, determining if the at least one common pattern of behavior is indicative of malicious software, wherein correlating includes a first-level determination of identifying that a frequency of DNS requests occurs at regular intervals and, wherein determining includes a second-level determination including a weighted calculation using a percentage of unresolved lookups and a probability of statistically random domain names, which includes a determination of how numbers are placed throughout the domain names.

A computer-readable storage, which is nonvolatile, including instructions thereon for executing a method of detecting that malicious software is present on host server computers, comprising:

• monitoring a plurality of Domain Name System (DNS) requests from the host server computers in a multi-tenant environment;
• correlating DNS requests across tenants or across software instances from a same tenant by determining if the DNS requests have a same time frequency in which they re-occur;
• for correlated DNS requests that have the same frequency, determining whether the DNS requests have one or more of the following characteristics:
• the DNS requests are statistically random, the DNS requests include a domain name that is on a blacklist of known corrupted DNS domain names;
• or the DNS requests exceed a predetermined percentage of requests that are not resolvable;
• and
• for responses to the DNS requests, determining if at least one response includes a text message and analyzing whether the text message is statistically random, which includes analyzing how numbers are placed throughout the domain name.

A system for detecting malicious software present on one or more computers, comprising:

• two or more host computers for executing virtual machines in a multi-tenant environment;
• a Domain Name System (DNS) server computer coupled to the two or more host computers;
• a DNS-analysis engine coupled to the DNS server for correlating patterns of behavior associated with DNS requests from the two or more host computers indicative of malicious software;
• and
• the DNS-analysis engine further for analyzing a response to at least one of the DNS requests to determine if the response includes a text message that is statistically random, wherein the determination of whether the response includes a text message that is statistically random includes determining how numbers are placed through the text message.