DETECTING ALGORITHMICALLY GENERATED DOMAINS IN REGISTERED DOMAIN DATA

1 . A system, comprising:

a processor configured to:

collect registered domain names;

generate a graph of the registered domain names and outlier substrings associated with each of the registered domain names; and

generate a set of registered DGA domain clusters based on an automated analysis of the graph; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system recited in claim 1 , wherein the registered domain names are collected from a plurality of sources including domains names that have been newly observed or registered within a predetermined period of time.

3 . The system recited in claim 1 , wherein the graph is a bi-partite graph.

4 . The system recited in claim 1 , wherein the graph is a bi-partite graph, wherein connected components of the graph are identified, and wherein each component of the graph is automatically classified using a statistical classifier.

5 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters.

6 . The system recited in claim 1 , wherein the processor is further configured to:

calculate n-long substrings for each of the registered domain names; and

identify n-long substring statistical outliers, wherein the graph is generated using the registered domain names and the n-long substring statistical outliers.

7 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

perform an action based on a policy in response to detecting a query associated with the new threat domain.

8 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

block the new threat domain at a DNS security platform based on a policy.

9 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

generate an alert in response to detecting a query associated with the new threat domain at a DNS security platform based on a policy.

10 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

report the new threat domain.

11 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

add the new threat domain to a block list.

12 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

quarantine new the threat domain.

13 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters, and wherein the processor is further configured to:

automatically generate a new DNS signature for the new threat domain.

14 . A method, comprising:

collecting registered domain names;

generating a graph of the registered domain names and outlier substrings associated with each of the registered domain names; and

generating a set of registered DGA domain clusters based on an automated analysis of the graph.

15 . The method of claim 14 , wherein the registered domain names are collected from a plurality of sources including domains names that have been newly observed or registered within a predetermined period of time.

16 . The method of claim 14 , wherein the graph is a bi-partite graph.

17 . The method of claim 14 , wherein the graph is a bi-partite graph, wherein connected components of the graph are identified, and wherein each component of the graph is automatically classified using a statistical classifier.

18 . The method of claim 14 , wherein a new threat domain is identified based on being associated with one or more of the set of registered DGA domain clusters.

19 . The method of claim 14 , further comprising:

calculating n-long substrings for each of the registered domain names; and

identifying n-long substring statistical outliers, wherein the graph is generated using the registered domain names and the n-long substring statistical outliers.

20 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

collecting registered domain names;

generating a graph of the registered domain names and outlier substrings associated with each of the registered domain names; and

generating a set of registered DGA domain clusters based on an automated analysis of the graph.