Granted Patent B2

US 9,922,190 · App. 13/749,205 · Granted Mar 20, 2018

Abstract

Claims (34)

1. A method for detecting a domain generation algorithm (DGA), comprising:

obtaining, from an electronic database, a plurality of non-existent (NX) domain names comprising a top-level domain (TLD), a second-level domain (2LD), and a third-level domain (3LD);

clustering, utilizing a name-based clustering module, a portion of the plurality of NX domain names based on at least one of n-gram features (NGF), entropy-based features (EBF), and structural domain features (SDF);

wherein the TLD, 2LD, and 3LD are all utilized by the name-based clustering module;

clustering, utilizing a graph clustering module, another portion of the plurality of NX domain names based on groups of assets that queried the NX domain names;

associating, utilizing a daily clustering correlation module, one or more NX domain names from the name based clustering model with one or more NX domain names from the graph clustering model;

responsive to the daily clustering, associating, utilizing a temporal clustering correlation module, one or more NX domain names from different clusters based on a rolling window of two consecutive epochs; and

determining whether a DGA that generated the clustered NX domain is unknown.

2. The method of claim 1 , further comprising: responsive to determining that a DGA is unknown sending the unknown DGA to a DGA classification module.

3. The method of claim 2 , further comprising: modeling the DGA.

4. The method of claim 3 , further comprising: providing a report about the DGA.

5. The method of claim 1 , further comprising: monitoring DNS traffic below a local recursive DNS server;

wherein the DNS traffic is stored in the electronic database.

6. The method of claim 1 , wherein unknown DGA are used to train new DGA classifier modules.

7. A system for detecting a domain generation algorithm (DGA), comprising:

a non-transitory device comprising a processor 2

obtain, form an electronic database, a plurality of non-existent (NX) domain names comprising a top-level domain (TLD), a second-level domain (2LD), and a third-level domain (3LD);

cluster, utilizing a name-based clustering module, a portion of the plurality of NX domain names based on at least one of n-gram features (NGF), entropy-based features (EBF), and structural-domain features (SDF);

wherein the TLD, 2LD, and 3LD are all utilized by the name-based clustering module;

cluster, utilizing a graph clustering module, another portion of the plurality of NX domain names based on groups of assets that queried the NX domain names;

associate, utilizing a daily clustering correlation module, one or more NX domain from the name based clustering model with one or more NX domain names from the graph clustering model;

responsive to the daily clustering, associate, utilizing a temporal clustering correlation module, one or more NX domain names from different clusters based on a rolling window of two consecutive epochs; and

determine whether a DGA that generated the clustered NX domain names is unknown.

8. The system of claim 7 , wherein the processor is further configured to: responsive to the determination that a DGA is unknown sending the unknown DGA to a DGA classification module.

9. The system of claim 8 , wherein the processor is further configured to: model the DGA.

10. The system of claim 9 , wherein the processor is further configured to: provide a report about the DGA.

11. The system of claim 7 , wherein the processor is further configured to: monitor DNS traffic below a local recursive DNS server.

12. The system of claim 8 , wherein unknown DGA are used to train new DGA classifier modules.

13. The method of claim 1 , wherein the clustering is based on n-gram features, and wherein the n-gram features comprise: measuring a frequency distribution of one or more n-grams across the TLD, 2LD, and 3LD of the portion of the plurality of NX domain names.

14. The method of claim 1 , wherein the clustering is based on entropy-based features, and wherein the entropy-based features comprise: determining a level of randomness for the portion of the plurality of NX domain names based on computing an entropy of a character distribution for the 2LD and the 3LD.

15. The method of claim 1 , wherein the clustering is based on structural domain features, and wherein the structural domain features comprise: determining an average, median, standard deviation, and variance for the portion of the plurality of NX domain names based on a length and number of domain levels for each NX domain.

16. The system of claim 7 , wherein the clustering is based on n-gram features, and wherein the n-gram features comprise: measuring a frequency distribution of one or more n-grams across the TLD, 2LD, and 3LD of the portion of the plurality of NX domain names.

17. The system of claim 7 , wherein the clustering is based on entropy-based features, and wherein the entropy-based features comprise: determining a level of randomness for the portion of the plurality of NX domain names based on computing an entropy of a character distribution for the 2LD and the 3LD.

18. The system of claim 7 , wherein the clustering is based on structural domain features, and wherein the structural domain features comprise: determining an average, median, standard deviation, and variance for the portion of the plurality of NX domain names based on a length and number of domain levels for each NX domain.

Assignments (19)