System and method to detect domain generation algorithm malware and systems infected by such malware
Systems and methods for detection of domain generated algorithms (DGA) and their command and control (C&C) servers are disclosed. In one embodiment, such an approach includes examining DNS queries for DNS resolution failures, and monitoring certain set of parameters such as number of levels, length of domain name, lexical complexity, and the like for each failed domain. These parameters may then be compared against certain thresholds to determine if the domain name is likely to be part of a DGA malware. Domain names identified as being part of a DGA malware may then be grouped together. Once a DGA domain name has been identified, activity from that domain name can be monitored to detect successful resolutions from the same source to see if any of the successful domain resolutions match these parameters. If they match specific thresholds, then the domain is determined to be a C&C server of the DGA malware and may be identified as such.
1. A computer readable storage disk or storage device comprising instructions to cause a machine to at least:
capture domain name services queries included in communications on a computer network to detect a communication including a domain name;
compare characters in the domain name with words in a dictionary to identify a combination of words in the domain name and a subset of the characters that are not in the words;
determine a count of a number of characters in the combination of words in the domain name, the count does not include remaining characters in the domain name that are not in the words;
determine a lexical complexity of the domain name based on the combination of words in the domain name excluding the characters that are not in the words;
based on a determination that the count of the number of characters in the domain name falls within a specified range and a determination that the lexical complexity of the domain name satisfies an average lexical complexity threshold for a list of domain names associated with a domain generation algorithm (DGA):
query a domain name registrar server to determine an age of the domain name; and
identify the domain name as a command and control domain of the DGA when the age is less than a second threshold.
2. The computer readable storage disk or storage device of claim 1 , wherein the specified range is between a smallest domain name length and a largest domain name length of domain names listed in the list of domain names.
3. The computer readable storage disk or storage device of claim 1 , wherein the instructions, when executed, cause the machine to determine if a Domain Name Server (DNS) response indicates the domain name failed resolution.
4. The computer readable storage disk or storage device of claim 1 , wherein the instructions, when executed, cause the machine to determine the age based on a domain creation date identified in a WHOIS database.
5. The computer readable storage disk or storage device of claim 1 , wherein the instructions, when executed, cause the machine to determine if the domain name is on a source internet protocol (IP) watch list.
6. The computer readable storage disk or storage device of claim 5 , wherein the instructions, when executed, cause the machine to determine the age of the domain name when the domain name is on the source IP watch list.
7. The computer readable storage disk or storage device of claim 1 , wherein the instructions, when executed, cause the machine to determine the second threshold based on an age of command and control domains criterion.
8. The computer readable storage disk or storage device of claim 1 , wherein the instructions, when executed, cause the machine to select the combination of words from a plurality of combinations of words for the domain name based on a determination that the combination of words results in a least number of characters remaining in the domain name after the combination of words is removed as compared with others of the plurality of combinations.
9. A method comprising:
capturing, by executing an instruction with at least one processor, domain name services queries included in on a computer network to detect a communication including a domain name;
comparing characters in the domain name with words in a dictionary to identify a combination of words in the domain name and characters that are not in the words;
determining a count of a number of characters in the combination of words in the domain name, the count does not include remaining characters in the domain name that are not in the words;
determine a lexical complexity of the domain name based on the combination of words in the domain name excluding the characters that are not in the words;
based on a determination that the count of the number of characters in the domain name falls within a specified range and a determination that the lexical complexity of the domain name satisfies an average lexical complexity threshold for a list of domain names associated with a domain generation algorithm (DGA):
querying, by executing an instruction with the at least one processor a domain name registrar server to determine an age of the domain name; and
identifying, by executing an instruction with the at least one processor, the domain name as a command and control domain of the DGA when the age is less than a second threshold.
10. The method of claim 9 , wherein the specified range is between a smallest domain name length and a largest domain name length of domain names listed in the list of domain names.
11. The method as defined in claim 9 , further including determining if a Domain Name Server (DNS) response indicates the domain name failed resolution.
12. The method as defined in claim 9 , further including determining the age based on a domain creation date identified in a WHOIS database.
13. The method as defined in claim 9 , further including determining if the domain name is on a source internet protocol (IP) watch list.
14. The method as defined in claim 13 , further including determining the age of the domain name when the domain name is on the source IP watch list.
15. The method as defined in claim 9 , further including determining the second threshold based on an age of command and control domains criterion.