Systems and methods of identifying suspicious hostnames
A method includes receiving a set of strings and applying one or more filters to generate a subset of strings that are determined to correspond to strings of interest. The method also includes retrieving domain name system (DNS) information associated with a first string of the subset. The method includes executing a rule-based engine to determine, based on application of one or more rules to the DNS information, whether to add the first string to a set of suspicious hostnames.
1. A method comprising:
receiving, via an input interface, a string that corresponds to a hostname;
identifying, at a computing device, a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings;
applying, at the computing device, a filter to determine whether to add the string to a set of potentially suspicious hostnames, the filter including an entropy filter and a recency filter configured to indicate that the string is potentially suspicious in response to determining that the hostname was registered or encountered by the computing device within a threshold time period, wherein the filter is configured to add the string to the set of potentially suspicious hostnames in response to the entropy filter and the recency filter each indicating that the string is potentially suspicious, wherein the entropy filter is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string;
retrieving at least one domain name system (DNS) record based on the string or based on a DNS record previously retrieved based on the string;
executing a rule-based engine to determine whether to add the string to a set of suspicious hostnames; and
providing the set of suspicious hostnames to a distributed denial of service (DDoS) attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames.
2. The method of claim 1 , wherein the at least one other filter further includes:
an international domain name (IDN) filter configured to indicate that the string is potentially suspicious in response to determining that the string starts with an IDN prefix;
a top level domain (TLD) filter configured to indicate that the string is potentially suspicious in response to determining that the string is a TLD;
a length filter configured to indicate that the string is potentially suspicious in response to determining that a length of the string satisfies a length threshold;
or
a combination thereof.
3. The method of claim 1 , further comprising:
identifying a second string based on the at least one DNS record, wherein the second string is distinct from the string;
retrieving at least one second DNS record associated with the second string; and
executing the rule-based engine to determine, based on application of one or more rules to the at least one second DNS record, whether to add the second string to the set of suspicious hostnames.
4. The method of claim 3 , further comprising:
identifying a third string based on the at least one second DNS record, wherein the third string is distinct from the string and the second string;
retrieving at least one third DNS record associated with the third string; and
executing the rule-based engine to determine, based on application of one or more rules to the at least one third DNS record, whether to add the third string to the set of suspicious hostnames.
5. The method of claim 1 , wherein the at least one DNS record is retrieved from an external DNS database and comprises at least one of an address (A) record, a canonical name (CNAME) record, or a name server (NS) record.
6. The method of claim 1 , wherein the at least one DNS record maps the hostname to a network accessible entity, and further comprising adding, by the rule-based engine, the string to the set of suspicious hostnames in response to determining that the network accessible entity is associated with a second string included in the set of suspicious hostnames.
7. The method of claim 1 , wherein the at least one DNS record maps a network accessible entity to the hostname, and further comprising adding, by the rule-based engine, the string to the set of suspicious hostnames in response to determining that greater than a threshold percentage of DNS records that map to the hostname are associated with one or more second strings included in the set of suspicious hostnames.
8. The method of claim 1 , wherein the first set of strings excludes hostnames that have been determined to be suspicious.
9. The method of claim 1 , wherein the first set of strings excludes hostnames that have been determined to be non-suspicious.
10. The method of claim 1 , wherein the entropy filter is configured to classify the string based on a comparison of the n-gram entropy of the string to an n-gram entropy threshold.
11. The method of claim 10 , wherein the n-gram entropy threshold is further determined based on user input.
12. The method of claim 10 , further comprising determining the n-gram entropy threshold by:
sorting the first set of strings by n-gram entropy; and
selecting the n-gram entropy threshold such that at least a particular percentage of the first set of strings fail to satisfy the n-gram entropy threshold.
13. The method of claim 1 , wherein the n-gram entropy comprises a sum, a weighted sum, an average, or a weighted average of entries of the data structure that correspond to the n-grams included in the string.
14. The method of claim 1 , further comprising blocking at least one incoming e-mail responsive to determining that a source of the at least one incoming e-mail is included in the set of suspicious hostnames.
15. A computer-readable storage device comprising instructions that, when executed by a computer, cause the computer to perform operations comprising:
identifying a string received via an input interface of the computer, wherein the string corresponds to a hostname;
identifying a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings;
applying a filter operation to determine whether to add the string to a set of potentially suspicious hostnames, the filter operation including an entropy filter operation and a recency filter operation configured to indicate that the string is potentially suspicious in response to determining that the hostname was registered or encountered by the computing device within a threshold time period, and wherein the filter operation is configured to add the string to the set of potentially suspicious hostnames in response to the entropy filter operation and the recency filter operation each indicating that the string is potentially suspicious, wherein the entropy filter operation is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string;
retrieving at least one domain name system (DNS) record based on the string or based on a DNS record previously retrieved based on the string;
executing a rule-based engine to determine whether to add the string to a set of suspicious hostnames; and
providing the set of suspicious hostnames to a distributed denial of service (DDoS) attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames.
16. The computer-readable storage device of claim 15 , wherein the operations further comprise classifying the string into one or more of a plurality of classification categories, wherein the plurality of classification categories includes at least a malware category and a phishing category.
17. The computer-readable storage device of claim 15 , wherein the string is received from a mobile security feed, a spam filtering feed, an e-mail security feed, a DNS query feed, or any combination thereof.
18. A system comprising:
a memory configured to store a set of potentially suspicious hostnames and a set of suspicious hostnames;
a processor; and
a filtering module executable by the processor to:
receive a string that corresponds to a hostname;
identify a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set strings;
apply a filter to determine whether to add the string to the set of potentially suspicious hostnames, the filter including an entropy filter and a recency filter configured to indicate that the string is potentially suspicious in response to determining that the hostname was registered or encountered by the computing device within a threshold time period, wherein the filter is configured to add the string to the set of potentially suspicious hostnames in response to the entropy filter and the recency filter each indicating that the string is potentially suspicious, wherein the entropy filter is configured to indicate that the string is potentially suspicious strings based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string;
retrieve at least one domain name system (DNS) record based on the string or based on a DNS record previously retrieved based on the string;
execute a rule-based engine to determine whether to add the string to the set of suspicious hostnames; and
provide the set of suspicious hostnames to a distributed denial of service (DDoS) attack mitigation application configured to selectively ignore DNS queries that are received from sources included in the set of suspicious hostnames.