Detection of algorithmically generated domains based on a dictionary

1. A system, comprising:

a processor configured to:

receive a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;

detect DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and

perform a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the mitigation action includes blocking the DNS response.

3. The system recited in claim 1 , wherein the DNS response for resolution of the DNS query includes an IP address, and wherein the processor is further configured to:

add the IP address associated with a potentially malicious network domain to a blacklist.

4. The system recited in claim 1 , wherein the DNS response for resolution of the DNS query includes an IP address, and wherein the processor is further configured to:

send the IP address associated with a potentially malicious network domain to a firewall.

5. The system recited in claim 1 , wherein the processor is further configured to perform one or more mitigation actions comprising to:

generate a firewall rule based on a potentially malicious network domain;

configure a network device to block network communications with the potentially malicious network domain;

quarantine an infected host, wherein the infected host is determined to be infected based on an association with the potentially malicious network domain; and

add the potentially malicious network domain to a reputation feed.

6. The system recited in claim 1 , wherein the processor is further configured to:

identify a source IP address, a source host, or an attempt to query a potentially malicious network domain.

7. The system recited in claim 1 , wherein the DNS stream includes NXDOMAIN traffic.

8. The system recited in claim 1 , wherein the DNS stream is automatically filtered to identify natural language related domains included in the DNS stream.

9. The system recited in claim 1 , wherein the DNS stream is automatically filtered to identify natural language related domains included in the DNS stream using a classifier.

10. The system recited in claim 1 , wherein the DNS stream is automatically filtered to remove domains associated with traditional DGA malware.

11. The system recited in claim 1 , wherein the processor is further configured to:

filter the DNS stream, wherein the DNS stream is automatically filtered using a classifier to identify natural language related domains included in the DNS stream; and

output the filtered DNS stream for generating the graph using the identified natural language related domains included in the DNS stream.

12. The system recited in claim 1 , wherein the processor is further configured to:

filter the DNS stream, wherein the DNS stream is automatically filtered using a classifier to identify natural language related domains included in the DNS stream; and

output the filtered DNS stream for clustering the identified natural language related domains included in the DNS stream prior to generating the graph based on the DNS stream.

13. The system recited in claim 1 , wherein the processor is further configured to:

detect command and control botnet related activity based on the malicious dictionary.

14. A method, comprising:

receiving a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;

detecting DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and

performing a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware.

15. The method of claim 14 , wherein the mitigation action includes blocking the DNS response.

16. The method of claim 14 , wherein the DNS response for resolution of the DNS query includes an IP address, and further comprising:

add the IP address associated with a potentially malicious network domain to a blacklist.

17. The method of claim 14 , wherein the DNS response for resolution of the DNS query includes an IP address, and further comprising:

send the IP address associated with a potentially malicious network domain to a firewall.

18. The method of claim 14 , further comprising:

generate a firewall rule based on a potentially malicious network domain;

configure a network device to block network communications with the potentially malicious network domain;

quarantine an infected host, wherein the infected host is determined to be infected based on an association with the potentially malicious network domain; and

add the potentially malicious network domain to a reputation feed.

19. The method of claim 14 , further comprising:

identify a source IP address, a source host, or an attempt to query a potentially malicious network domain.

20. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a Domain Name System (DNS) stream, wherein the DNS stream includes a DNS query and a DNS response for resolution of the DNS query;

detecting DNS activity associated with a malicious dictionary associated with a new Dictionary Domain Generation Algorithms (DDGA) malware based on monitored live DNS traffic, wherein detecting DNS activity associated with a malicious dictionary associated with a new DDGA malware based on monitored live DNS traffic comprises identifying a malicious dictionary based on a graph generated based on the DNS stream, comprising:

extracting a set of words from natural language related domains in the DNS data stream;

splitting the natural language related domains into a plurality of sets, wherein each natural language related domain of at least one set of the plurality of sets has different domains, and wherein all of the natural language related domains of the at least one set have the same top-level domain; and

obtaining the graph from the at least one set of the plurality of sets, wherein two words of the graph are connected in the event that the two words co-occur in the same one set; and

performing a mitigation action in response to detecting the DNS activity associated with the malicious dictionary associated with the new DDGA malware.