Detecting suspicious network behaviors based on domain name service failures

1. A method for detecting a malicious node in a network, comprising:

obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name;

generating, by a computer processor device and using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm;

determining, by the computer processor and using a pre-determined formula, a score representing statistical characteristics of the cluster, wherein statistical characteristics include a cohesive measure, a size measure, and a repetitiveness measure, the cohesive measure representing similarity among the portion of the plurality of eSLD names included in the cluster, the size measure representing a tally of the eSLD names included in the cluster, and the repetitiveness measure representing a number of similar subsets of the cluster repetitively occurring at different time epochs; and

assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.

2. The method of claim 1 , further comprising:

using the cohesiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the cohesiveness measure.

3. The method of claim 1 , further comprising:

using the size measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the size measure.

4. The method of claim 1 , further comprising:

using the repetitiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the repetitiveness measure.

5. The method of claim 1 , further comprising:

calculating an inter-arrival time measure of the cluster to represent an average inter-arrival time of the eSLD name in the portion; and

using the inter-arrival time measure as an input of the pre-determined formula to determine the score,

wherein the score is inversely proportional to the inter-arrival time measure.

6. The method of claim 1 ,

wherein the pre-determined clustering algorithm is based on at least one selected from a group consisting of a randomness measure, a Jaccard distance, an edit distance, and a substring test associated with the eSLD name in each of the plurality of failed DNS queries.

7. The method of claim 1 , further comprising:

obtaining a successful DNS query from the network, wherein the successful DNS query is initiated from the client node and comprises another eSLD name;

comparing the another eSLD name to the cluster to determine a match; and

assigning, in response to the match, the malicious status to a server node identified based on a server IP address returned by the successful DNS query.

8. The method of claim 1 , further comprising:

extracting an eSLD name pattern from the portion of the plurality of eSLD names;

obtaining another failed DNS query from the network, wherein the another failed DNS query is initiated from another client node and comprises another eSLD name;

comparing the another eSLD name to the eSLD name pattern to determine a match; and

assigning, in response to the match, the malicious status to the another client node.

9. A system for detecting a malicious node in a network, comprising:

a processor device; and

memory storing instructions executable by the processor, wherein the instructions comprises:

a cluster generation module configured to:

obtain a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name; and

generate, using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm;

a cluster evaluation module configured to:

determine, using a pre-determined formula, a score representing statistical characteristics of the cluster, wherein statistical characteristics include a cohesive measure, a size measure, and a repetitiveness measure, the cohesive measure representing similarity among the portion of the plurality of eSLD names included in the cluster, the size measure representing a tally of the eSLD names included in the cluster, and the repetitiveness measure representing a number of similar subsets of the cluster repetitively occurring at different time epochs; and

a malicious status assigning module configured to:

assign, in response to the score meeting a pre-determined criterion, a malicious status to the client node; and

a repository configured to store the plurality of eSLD names and the cluster.

10. The system of claim 9 , the cluster evaluation module further configured to:

use the cohesiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the cohesiveness measure.

11. The system of claim 9 , the cluster evaluation module further configured to:

use the size measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the size measure.

12. The system of claim 9 , the cluster evaluation module further configured to:

use the repetitiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the repetitiveness measure.

13. The system of claim 9 , the cluster evaluation module further configured to:

calculate an inter-arrival time measure of the cluster to represent an average inter-arrival time of the eSLD name in the portion; and

use the inter-arrival time measure as an input of the pre-determined formula to determine the score,

wherein the score is inversely proportional to the inter-arrival time measure.

14. The system of claim 9 ,

wherein the pre-determined clustering algorithm is based on at least one selected from a group consisting of a randomness measure, a Jaccard distance, an edit distance, and a substring test associated with the eSLD name in each of the plurality of failed DNS queries.

15. The system of claim 9 , the malicious status assigning module further configured to:

obtain a successful DNS query from the network, wherein the successful DNS query is initiated from the client node and comprises another eSLD name;

compare the another eSLD name to the cluster to determine a match; and

assign, in response to the match, the malicious status to a server node identified based on a server IP address returned by the successful DNS query.

16. The system of claim 9 , the malicious status assigning module further configured to:

extract an eSLD name pattern from the portion of the plurality of eSLD names;

obtain another failed DNS query from the network, wherein the another failed DNS query is initiated from another client node and comprises another eSLD name;

compare the another eSLD name to the eSLD name pattern to determine a match; and

assign, in response to the match, the malicious status to the another client node.

17. A non-transitory computer readable medium embodying instructions for detecting a malicious node in a network, the instructions when executed by a processor device comprising functionality for:

obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name;

generating, using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm;

determining, using a pre-determined formula, a score representing statistical characteristics of the cluster, wherein statistical characteristics include a cohesive measure, a size measure, and a repetitiveness measure, the cohesive measure representing similarity among the portion of the plurality of eSLD names included in the cluster, the size measure representing a tally of the eSLD names included in the cluster, and the repetitiveness measure representing a number of similar subsets of the cluster repetitively occurring at different time epochs; and

assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.

18. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

using the cohesiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the cohesiveness measure.

19. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

using the size measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the size measure.

20. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

using the repetitiveness measure as an input of the pre-determined formula to determine the score,

wherein the score is proportional to the repetitiveness measure.

21. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

calculating an inter-arrival time measure of the cluster to represent an average inter-arrival time of the eSLD name in the portion; and

using the inter-arrival time measure as an input of the pre-determined formula to determine the score,

wherein the score is inversely proportional to the inter-arrival time measure.

22. The non-transitory computer readable medium of claim 17 ,

wherein the pre-determined clustering algorithm is based on at least one selected from a group consisting of a randomness measure, a Jaccard distance, an edit distance, and a substring test associated with the eSLD name in each of the plurality of failed DNS queries.

23. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

obtaining a successful DNS query from the network, wherein the successful DNS query is initiated from the client node and comprises another eSLD name;

comparing the another eSLD name to the cluster to determine a match; and

assigning, in response to the match, the malicious status to a server node identified based on a server IP address returned by the successful DNS query.

24. The non-transitory computer readable medium of claim 17 , the instructions when executed by the processor further comprising functionality for:

extracting an eSLD name pattern from the portion of the plurality of eSLD names;

obtaining another failed DNS query from the network, wherein the another failed DNS query is initiated from another client node and comprises another eSLD name;

comparing the another eSLD name to the eSLD name pattern to determine a match; and

assigning, in response to the match, the malicious status to the another client node.