Identifying command and control endpoint used by domain generation algorithm (DGA) malware

1. A method to identify a command endpoint used by Domain Generation Algorithm (DGA) malware, comprising:

identifying at least one attribute associated with a candidate resolved Domain Name Service (DNS) name, and that has associated therewith a set of names that are failed DNS lookups and that cluster with the candidate resolved DNS name;

identifying a set of additional names that share the at least one attribute with the candidate resolve DNS name;

for the set of additional names, determining an extent to which the set of additional names also clusters with the set of names that are failed DNS lookups by computing, for at least one additional name, an aggregate score based on a number of additional names that cluster with the set of names that are failed DNS lookups and determining whether the aggregate score meets or exceeds a configurable degree; and

characterizing the candidate resolved DNS name as associated with the command endpoint when the set of additional names clusters with the set of names that are failed DNS lookups to the configurable degree.

2. The method as described in claim 1 wherein a clustering technique used to cluster the candidate resolved DNS names with the set of names that are failed DNS lookups is also used to cluster the set of additional names.

3. The method as described in claim 1 wherein determining the extent to which the set of additional names also clusters with the set of names that are failed DNS lookups includes, for each additional name:

determining whether the additional name clusters with the set of names that are failed DNS lookup;

for each additional name that clusters with the set of names that are failed DNS lookups, providing a first determination;

for each additional name that does not cluster with the set of names that are failed DNS lookups, providing a second determination.

4. The method as described in claim 3 further including;

computing the aggregate score based on a number of first determinations; and

determining whether the number of first determinations meets or exceeds the configurable degree.

5. The method as described in claim 1 wherein the at least one attribute is one of:

an IP address, data derived from a name server record associated with the candidate resolved DNS data, an identity of a client that issued a DNS query to the candidate resolved DNS name, and combinations thereof.

6. The method as described in claim 1 further including:

using another attribute associated with the candidate resolved DNS name to identify a second set of additional names;

for the second set of additional names, determining an extent to which the second set of additional names also clusters with the set of names that are failed DNS lookups; and

characterizing the candidate resolved DNS name as associated with the command endpoint when both the set of additional names and the second set of additional names cluster with the set of names that are failed DNS lookups.

7. The method as described in claim 1 wherein a machine learning clustering technique is used to determine the candidate resolved DNS clusters with the set of names that are failed DNS lookups.

8. An apparatus, comprising:

a processor;

computer memory holding computer program instructions executed by the processor, the computer program instructions configured to identify a command endpoint used by Domain Generation Algorithm (DGA) malware, the computer program instructions comprising:

program code to identify at least one attribute associated with a candidate resolved Domain Name Service (DNS) name, and that has associated therewith a set of names that are failed DNS lookups and that cluster with the candidate resolved DNS name;

program code to identify a set of additional names that share the at least one attribute with the candidate resolved DNS name;

program code to determine, for each of the set of additional names, an extent to which the set of additional names also clusters with the set of names that are failed DNS lookups by computing, for at least one additional name, an aggregate score based on a number of additional names that cluster with the set of names that are failed DNS lookups and determining whether the aggregate score meets or exceeds a configurable degree; and

program code to characterize the candidate resolved DNS name as associated with the command endpoint when the set of additional names clusters with the set of names that are failed DNS lookups to the configurable degree.

9. The apparatus as described in claim 8 wherein a clustering technique used to cluster the candidate resolved DNS names with the set of names that are failed DNS lookups is also used to cluster the set of additional names.

10. The apparatus as described in claim 8 wherein the program code to determine the extent to which the set of additional names also clusters with the set of names that are failed DNS lookups includes program code that, for each additional name:

determines whether the additional name clusters with the set of names that are failed DNS lookup;

for each additional name that clusters with the set of names that are failed DNS lookups, provides a first determination;

for each additional name that does not cluster with the set of names that are failed DNS lookups, provides a second determination.

11. The apparatus as described in claim 10 wherein the program code to characterize the candidate resolved DNS name further includes;

program code to compute the aggregate score based on a number of first determinations; and

program code to determine whether the number of first determinations meets or exceeds the configurable degree.

12. The apparatus as described in claim 8 wherein the at least one attribute is one of: an IP address, data derived from a name server record associated with the candidate resolved DNS data, an identity of a client that issued a DNS query to the candidate resolved DNS name, and combinations thereof.

13. The apparatus as described in claim 8 wherein the computer program instructions further include:

program code using another attribute associated with the candidate resolved DNS name to identify a second set of additional names;

program code to determine, for the second set of additional names, an extent to which the second set of additional names also clusters with the set of names that are failed DNS lookups; and

program code to characterize the candidate resolved DNS name as associated with the command endpoint when both the set of additional names and the second set of additional names cluster with the set of names that are failed DNS lookups.

14. The apparatus as described in claim 8 wherein a machine learning clustering technique is used to determine the candidate resolved DNS clusters with the set of names that are failed DNS lookups.

15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to identify a command endpoint used by Domain Generation Algorithm (DGA) malware, the computer program instructions comprising:

program code to identify at least one attribute associated with a candidate resolved Domain Name Service (DNS) name, and that has associated therewith a set of names that are failed DNS lookups and that cluster with the candidate resolved DNS name;

program code to identify a set of additional names that share the at least one attribute with the candidate resolved DNS name;

program code to determine, for each of the set of additional names, an extent to which the set of additional names also clusters with the set of names that are failed DNS lookups by computing, for at least one additional name, an aggregate score based on a number of additional names that cluster with the set of names that are failed DNS lookups and determining whether the aggregate score meets or exceeds a configurable degree; and

program code to characterize the candidate resolved DNS name as associated with the command endpoint when the set of additional names clusters with the set of names that are failed DNS lookups to the configurable degree.

16. The computer program product as described in claim 15 wherein a clustering technique used to cluster the candidate resolved DNS names with the set of names that are failed DNS lookups is also used to cluster the set of additional names.

17. The computer program product as described in claim 15 wherein the program code to determine the extent to which the set of additional names also clusters with the set of names that are failed DNS lookups includes program code that, for each additional name:

determines whether the additional name clusters with the set of names that are failed DNS lookup;

for each additional name that clusters with the set of names that are failed DNS lookups, provides a first determination;

for each additional name that does not cluster with the set of names that are failed DNS lookups, provides a second determination.

18. The computer program product as described in claim 17 wherein the program code to characterize the candidate resolved DNS name further includes;

program code to compute the aggregate score based on a number of first determinations; and

program code to determine whether the number of first determinations meets or exceeds the configurable degree.

19. The computer program product as described in claim 15 wherein the at least one attribute is one of: an IP address, data derived from a name server record associated with the candidate resolved DNS data, an identity of a client that issued a DNS query to the candidate resolved DNS name, and combinations thereof.

20. The computer program product as described in claim 15 wherein the computer program instructions further include:

program code using another attribute associated with the candidate resolved DNS name to identify a second set of additional names;

program code to determine, for the second set of additional names, an extent to which the second set of additional names also clusters with the set of names that are failed DNS lookups; and

program code to characterize the candidate resolved DNS name as associated with the command endpoint when both the set of additional names and the second set of additional names cluster with the set of names that are failed DNS lookups.

21. The computer program product as described in claim 15 wherein a machine learning clustering technique is used to determine the candidate resolved DNS clusters with the set of names that are failed DNS lookups.