Time-based detection of malware communications

1. A method comprising:

processing a plurality of domain name system queries generated by a host to identify a subset of the domain name system queries for which domain names contained in the domain name system queries were not resolved, wherein:

a given domain name system query of the plurality of domain name system queries represents an inquiry to acquire an internet protocol address for at least part of a first domain name;

said at least part of the first domain name belongs to a top level domain and a second level domain; and

processing the plurality of domain name system queries comprises:

determining whether another domain name system query of the plurality of domain name system queries is within a predetermined time span and represents an inquiry to acquire an internet protocol address for a second domain name belonging to the top level domain and the second level domain; and

excluding the given domain name system query from the subset of the domain name system queries based on a result of the determination; and

using a time-based analysis to detect domain generation algorithm-based malware communications by the host, wherein using the time-based analysis comprises determining whether the subset is anomalous based at least in part on a number of the domain name system queries of the subset occurring within the predetermined time span.

2. The method of claim 1 , wherein determining whether the subset is anomalous comprises comparing the number to a predetermined threshold.

3. The method of claim 1 , wherein excluding the given domain name system query further comprises:

determining whether the given domain name system query represents an inquiry to acquire an internet protocol address for a domain name that is represented by a white list.

4. The method of claim 1 , wherein using the time-based analysis determines that the subset is anomalous, the method further comprising:

performing false positive detection for the subset.

5. The method of claim 1 , further comprising acquiring the plurality of domain name system queries through mirroring, port taping or sniffing.

6. The method of claim 1 , wherein using the time-based analysis comprises determining whether the subset is anomalous based at least in part on the number occurring within a time span between three to ten seconds.

7. The method of claim 4 , wherein a query of the subset represents an inquiry to acquire an internet protocol address for at least part of a third domain name; and the performing of the false positive detection comprises comparing said at least part of the third domain name to domain names associated with domain name requests submitted by a plurality of other hosts to determine whether the query of the subset is associated with a script generator.

8. The method of claim 4 , wherein the performing of the false positive detection comprises determining whether second domain name system query of the set is associated with a domain that is associated with a domain name system query from the host or another host.

9. An article comprising a non-transitory computer readable storage medium to store instructions that, when executed by a computer, cause the computer to:

identify a set of anomalous queries provided by a first host based at least in part on a time rate of the anomalous queries of the set of anomalous queries and a determination of whether the anomalous queries of the set of anomalous queries are associated with unresolved domain names, wherein the time rate of the anomalous queries of the set of anomalous queries is based on a number of the anomalous queries of the set of anomalous queries occurring within a predetermined time span, wherein:

the first host provides a plurality of queries during the predetermined time span;

the plurality of queries comprises the set of anomalous queries;

a first query of the plurality of queries represents an inquiry to acquire an internet protocol address for at least part of a first domain name; and

said at least part of the first domain name belongs to a top level domain and a second level domain; and

identifying the set of anomalous queries comprises:

determining whether a second query of the plurality of queries is within the predetermined time span and represents an inquiry to acquire an internet protocol address for a second domain name belonging to the top level domain and the second level domain; and

excluding the first query from the set of anomalous queries based on a result of the determination.

10. The article of claim 9 , wherein the instructions, when executed by the computer, further cause the computer to compare a lower level domain associated with a query of the set of anomalous queries to lower level domains associated with domain name service queries provided by a plurality of hosts to determine whether the query of the set of anomalous queries is associated with a script.

11. The article of claim 9 , wherein the instructions, when executed by the computer, further cause the computer to generate an alert in response to an identification of the set of anomalous queries.

12. The article of claim 9 , wherein the instructions, when executed by the computer, further cause the computer to perform false positive removal for the set of anomalous queries based at least in part on a comparison of domain level associations of the set of anomalous queries to a domain level association of another domain name service query provided by a second host other than the first host.

13. An apparatus comprising:

a processor; and

a memory storing instructions that, when executed by the processor cause the processor to:

log network traffic data submitted by a plurality of hosts to a network;

identify sets of unresolved domain name system queries submitted by the plurality of hosts to the network, wherein each set is associated with a host of the plurality of hosts; and

determine whether the sets are anomalous based at least in part on time rates associated with the sets occurring within respective predetermined time spans, wherein:

a first set of the sets is associated with a first host of the plurality of hosts and occurs within a first respective predetermined time span of the respective predetermined time spans;

the first host provides a plurality of queries during the first respective predetermined time span;

a first query of the plurality of queries represents an inquiry to acquire an internet protocol address for at least part of a first domain name;

said at least part of the first domain name belongs to a top level domain and a second level domain; and

determining whether the sets are anomalous comprises:

determining whether a second query of the plurality of queries is within the first respective predetermined time span and represents an inquiry to acquire an internet protocol address for a second domain name belonging to the top level domain and the second level domain; and

excluding the first query from the first set based on a result of determining whether the second query is within the first respective predetermined time span and represents the inquiry to acquire the internet protocol address for the second domain name.

14. The apparatus of claim 13 , wherein the instructions, when executed by the processor, further cause the processor to perform false positive removal on a given set of the identified sets associated with a given host of the plurality of hosts based at least in part on comparisons of queries of the given set to queries associated with hosts of the plurality of hosts other than the given host.

15. The apparatus of claim 14 , wherein the performing of the false positive removal comprises removing queries associated with automatic scripts.