Detection of algorithmically generated domains based on a dictionary

1. A system, comprising:

a processor configured to:

receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

generate a graph based on the DNS data stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream, wherein each word in the set of words has at least 3 characters;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and

identify a malicious dictionary based on the graph; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the DNS data stream is a live DNS data stream.

3. The system recited in claim 1 , wherein the DNS data stream includes NXDOMAIN traffic.

4. The system recited in claim 1 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream.

5. The system recited in claim 1 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream using a classifier.

6. The system recited in claim 1 , wherein the DNS data stream is automatically filtered to remove domains associated with traditional DGA malware.

7. The system recited in claim 1 , wherein the processor is further configured to:

filter the DNS data stream, wherein the DNS data stream is automatically filtered using a classifier to identify the natural language related domains included in the DNS data stream; and

output the filtered DNS data stream for generating the graph using the identified natural language related domains included in the DNS data stream.

8. The system recited in claim 1 , wherein the processor is further configured to:

filter the DNS data stream, wherein the DNS data stream is automatically filtered using a classifier to identify the natural language related domains included in the DNS data stream; and

output the filtered DNS data stream for clustering the identified natural language related domains included in the DNS data stream prior to generating the graph based on the DNS data stream.

9. The system recited in claim 1 , wherein the processor is further configured to:

detect command and control botnet related activity based on the malicious dictionary.

10. A method, comprising:

receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

generating a graph based on the DNS data stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream,

wherein each word in the set of words has at least 3 characters;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and

identifying a malicious dictionary based on the graph.

11. The method of claim 10 , wherein the DNS data stream is a live DNS data stream.

12. The method of claim 10 , wherein the DNS data stream includes NXDOMAIN traffic.

13. The method of claim 10 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream.

14. The method of claim 10 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream using a classifier.

15. The method of claim 10 , wherein the DNS data stream is automatically filtered to remove domains associated with traditional DGA malware.

16. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

generating a graph based on the DNS data stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream, wherein each word in the set of words has at least 3 characters;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and identifying a malicious dictionary based on the graph.

17. The computer program product recited in claim 16 , wherein the DNS data stream is a live DNS data stream.

18. The computer program product recited in claim 16 , wherein the DNS data stream includes NXDOMAIN traffic.

19. The computer program product recited in claim 16 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream.

20. The computer program product recited in claim 16 , wherein the DNS data stream is automatically filtered to identify the natural language related domains included in the DNS data stream using a classifier.