Detecting DNS fast-flux anomalies

1. A method for detecting automatically generated malicious domain names in a network, comprising:

identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;

analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries;

analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set domain names; and

generating an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.

2. The method of claim 1 , further comprising:

identifying, in the network and in response to generating the alert, a source node of the plurality of DNS queries; and

facilitating in performing a network security operation with respect to the source node,

wherein the automatically generated malicious domain names are used for at least one selected from a group consisting of controlling a botnet and conducting a spam email campaign.

3. The method of claim 1 , wherein the common attribute comprises a top level domain name corresponding to the plurality of DNS queries.

4. The method of claim 1 , wherein the common attribute comprises an IP address that each of the plurality of DNS queries is mapped to.

5. The method of claim 1 , wherein the common attribute comprises a connected component that each of the plurality of DNS queries belongs to, the method further comprising performing connected component analysis of a IP-domain bipartite graph of the plurality of domain name service (DNS) queries.

6. The method of claim 1 , wherein each of the plurality of alphanumeric elements consists of at least one selected from a group consisting of a single alphanumeric character and n-consecutive alphanumeric characters where n represents an integer greater than one.

7. The method of claim 1 , wherein the distribution metric comprises information entropy of the plurality of alphanumeric elements.

8. A system for detecting automatically generated malicious domain names in a network, comprising:

a detecting program configured to capture a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;

an analyzer program configured to:

analyze the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries; and

analyze the plurality of alphanumeric elements to determine a distribution metric of the set of domain names; and

a processor and memory storing instructions when executed by the processor comprising functionality to:

compare the distribution metric and a pre-determined threshold to generate a result; and

generate an alert of domain fluxing based on the distribution metric according to a predetermined criterion.

9. The system of claim 8 , the instructions when executed by the processor further comprising functionality to:

identify, in the network and in response to generating the alert of domain fluxing, a source node of the plurality of DNS queries; and

facilitating in performing a network security operation with respect to the source node,

wherein the automatically generated malicious domain names are used for at least one selected from a group consisting of controlling a botnet and conducting a spam email campaign.

10. The system of claim 8 , wherein the common attribute comprises a top level domain name corresponding to the plurality of DNS queries.

11. The system of claim 8 , wherein the common attribute comprises an IP address that each of the plurality of DNS queries is mapped to.

12. The system of claim 8 , wherein the common attribute comprises a connected component that each of the plurality of DNS queries belongs to, the system further comprising a program for performing connected component analysis of an IP-domain bipartite graph of the plurality of domain name service (DNS) queries.

13. The system of claim 8 , wherein each of the plurality of alphanumeric elements consists of at least one selected from a group consisting of a single alphanumeric character and n-consecutive alphanumeric characters where n represents an integer greater than one.

14. The system of claim 8 , wherein the distribution metric comprises information entropy of the plurality of alphanumeric elements.

15. A non-transitory computer readable medium storing instructions for detecting automatically generated malicious domain names network in a network, the instructions when executed by a processor of a computer comprising functionality to:

identify a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute;

analyze the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries;

analyze the plurality of alphanumeric elements to determine a distribution metric of the set of domain names; and

generate an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.

16. The non-transitory computer readable medium of claim 15 , the instructions when executed by the processor further comprising functionality to:

identify, in the network and in response to generating the alert of domain fluxing, a source node of the plurality of DNS queries; and

facilitate in performing a network security operation with respect to the source node,

wherein the automatically generated malicious domain names are used for at least one selected from a group consisting of controlling a botnet and conducting a spam email campaign.