Granted Patent B1

US 10,944,781 · App. 16/018,041 · Granted Mar 9, 2021

Abstract

Claims (84)

1. A computer-implemented method for identifying malicious domain names from a passive domain name system server log, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

creating, at the computing device, a pool of domain names at least in part from the passive domain name system server log, wherein the passive domain name system server log is received from a domain name server;

identifying respective features of each domain name in the pool of domain names, wherein at least one of the respective features of each domain name in the pool of domain names describes a domain name server query access pattern of a user;

preparing a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names;

preparing a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names;

computing a classification model based at least in part on:

the respective features of each known benign domain name on the list of known benign domain names, and

the respective features of each known malicious domain name on the list of known malicious domain names;

identifying respective features of an unclassified domain name; and

classifying, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name.

2. The method of claim 1 , wherein each domain name in the pool of domain names is a fully-qualified domain name.

3. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a number of days since the domain name was initially present in the passive domain name server log;

identifying a number of days since the domain name was recently present in the passive domain name server log; and

identifying an age of the domain name.

4. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a total number of queries for the domain name;

identifying a standard deviation of the total number of queries for the domain name;

identifying an average number of queries per day for the domain name; and

identifying a standard deviation of the average number of queries per day for the domain name.

5. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a score describing the domain name is automatically generated; and

identifying a number of fully-qualified domain names of a main domain associated with the domain name.

6. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a total number of internet protocol (IP) addresses mapped to the domain name;

identifying an average number of IP addresses mapped to the domain name per day;

identifying a rate at which new IP addresses are mapped to the domain name;

identifying a rate at which new countries are associated with the domain name;

identifying a rate at which new IP prefixes are mapped to the domain name;

identifying a rate at which new organizations are associated with the domain name;

identifying an average lifetime of IP addresses mapped to the domain name;

identifying a total number of countries associated with IP addresses mapped to the domain name;

identifying a most recent time a new country was associated with IP addresses mapped to the domain name;

identifying a total number of IP prefixes to which IP addresses mapped to the domain name belong;

identifying a total number of organizations to which IP addresses mapped to the domain name belong;

identifying a ratio of IP addresses mapped to the domain name that are benign versus IP addresses mapped to the domain name that are known to have a connection to a malicious entity; and

identifying a number of other domain names that share an IP address with the domain name.

7. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a total number of internet protocol (IP) addresses that query the domain name;

identifying an average number of clients of the domain name per day;

identifying an average number of clients of the domain name per month;

identifying a rate at which new clients of the domain name query the domain name;

identifying a rate at which new countries, to which querying clients of the domain name belong, are present; and

identifying a rate at which new IP prefixes are present for clients querying the domain name.

8. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a number of distinct canonical names associated with the domain name;

identifying a rate at which new canonical names associated with the domain name are added; and

identifying an average age of canonical names associated with the domain name.

9. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a total number of name servers serving the domain name;

identifying a rate at which new name servers serving the domain name are added; and

identifying an average age of a name server serving the domain name.

10. The method of claim 1 , wherein identifying respective features of each domain name in the pool of domain names further comprises at least one of:

identifying a number of other domain names registered by an entity that registered the domain name; and

identifying a number of other domain names registered at the same time as the domain name.

11. The method of claim 1 , further comprising performing a security action in response to classifying the unclassified domain name as a malicious domain name.

12. The method of claim 11 , wherein the security action further comprises blocking access to a device associated with the malicious domain name.

13. The method of claim 1 , further comprising:

adding the malicious domain name to the list of known malicious domain names.

14. The method of claim 1 , further comprising:

sending the list of known malicious domain names to a malware detection system.

15. A system for identifying malicious domain names from a passive domain name system server log, the system comprising:

at least one physical processor;

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

create a pool of domain names at least in part from the passive domain name system server log, wherein the passive domain name system server log is received from a domain name server;

identify respective features of each domain name in the pool of domain names, wherein at least one of the respective features of each domain name in the pool of domain names describes a domain name server query access pattern of a user;

prepare a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names;

prepare a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names;

compute a classification model based at least in part on:

the respective features of each known benign domain name on the list of known benign domain names, and

the respective features of each known malicious domain name on the list of known malicious domain names;

identify respective features of an unclassified domain name; and

classify, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name.

16. The system of claim 15 , wherein each domain name in the pool of domain names is a fully-qualified domain name.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

create a pool of domain names at least in part from a passive domain name system server log, wherein the passive domain name system server log is received from a domain name server;

identify respective features of each domain name in the pool of domain names wherein at least one of the respective features of each domain name in the pool of domain names describes a domain name server query access pattern of a user;

prepare a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names;

prepare a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names;

compute a classification model based at least in part on:

the respective features of each known benign domain name on the list of known benign domain names, and

the respective features of each known malicious domain name on the list of known malicious domain names;

identify respective features of an unclassified domain name; and

classify, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name.

Assignments (6)