IP Library › Granted Patent US 10,812,501

Granted Patent B2

US 10,812,501 · App. 15/886,680 · Granted Oct 20, 2020

DGA behavior detection

Inventors: Wei Xu (Santa Clara, CA); Xin Ouyang (Santa Clara, CA)

Assignee: Palo Alto Networks, Inc.

H04L63/1416 H04L63/0236 H04L63/1425 H04L63/1483 H04L61/1511 H04L63/145 H04L2463/144

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,812,501
App. No.: 15/886,680
Granted: Oct 20, 2020
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Techniques for Domain Generation Algorithm (DGA) behavior detection are provided. In some embodiments, a system, process, and/or computer program product for DGA behavior detection includes receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and applying a signature to the passive DNS data to detect DGA behavior, in which applying the signature to the passive DNS data to detect DGA behavior further comprises: parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response.

Claims (162)

1. A system for Domain Generation Algorithm (DGA) behavior detection, comprising:

a processor of a security device configured to:

receive passive Domain Name System (DNS) data that comprises a plurality of DNS responses; and

apply a signature to the passive DNS data to detect DGA behavior, wherein apply the signature to the passive DNS data to detect DGA behavior further comprises:

parse each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response, comprises to:

in response to a determination that the DNS response corresponds to an NXDOMAIN response:

calculate an entropy of a host name in the DNS response using Shannon entropy;

determine whether the entropy satisfies a predetermined threshold; and

in response to a determination that the entropy fails to satisfy the predetermined threshold, disregard the DNS response; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the signature comprises an Intrusion Prevention System (IPS) signature.

3. The system recited in claim 1 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN.

4. The system recited in claim 1 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN, and wherein the NXDOMAIN response includes a destination IP address that corresponds to the host device.

5. The system recited in claim 1 , wherein a plurality of NXDOMAIN responses are received at the security device, and wherein one or more distinct host devices are determined based on distinct IP addresses associated with one or more of the plurality of NXDOMAIN responses received at the security device.

6. The system recited in claim 1 , wherein apply the signature to the passive DNS data to detect DGA behavior further comprises:

determine whether a threshold number of NXDOMAIN responses is received at the security device.

7. The system recited in claim 1 , wherein apply the signature to the passive DNS data to detect DGA behavior further comprises:

determine whether a threshold number of NXDOMAIN responses is received at the security device within a predetermined period of time.

8. The system recited in claim 1 , wherein the processor is further configured to:

determine that a first domain name is a DGA generated domain name based on detected DGA behavior using the signature, wherein the first domain name is associated with at least one of the one or more of the plurality of NXDOMAIN responses.

9. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using a sinkholed IP address.

10. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using the security device to redirect any host device that attempts to connect to the first domain name to a sinkholed IP address.

11. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using the security device to redirect any host device that attempts to connect to the first domain name to a sinkholed IP address, wherein the sinkholed IP address is associated with the security device.

12. The system recited in claim 1 , wherein the processor is further configured to:

13. The system recited in claim 1 , wherein the processor is further configured to:

14. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using a sinkholed IP address; and

monitor network activity redirected to the sinkholed IP address.

15. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using a sinkholed IP address; and

identify a first host device that is infected with malware based on an attempt by the first host device to connect to the first domain name, wherein the first host device is redirected to the sinkholed IP address in response to the attempt by the first host device to connect to the first domain name.

16. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using a sinkholed IP address; and

generate a log for each attempted host device connection that is redirected to the sinkholed IP address.

17. The system recited in claim 1 , wherein the processor is further configured to:

sinkhole the first domain name using a sinkholed IP address; and

report one or more host devices that attempt to connect to the sinkholed IP address.

18. The system recited in claim 1 , wherein the processor is further configured to:

determine one or more host devices that attempted to connect to the first domain name; and

perform an action in response to determining the one or more host devices that attempted to connect to the first domain name.

19. A method of Domain Generation Algorithm (DGA) behavior detection, comprising:

receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and

applying a signature to the passive DNS data to detect DGA behavior using a processor of the security device, wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response, comprises:

in response to a determination that the DNS response corresponds to an NXDOMAIN response:

calculating an entropy of a host name in the DNS response using Shannon entropy;

determining whether the entropy satisfies a predetermined threshold; and

in response to a determination that the entropy fails to satisfy the predetermined threshold, disregarding the DNS response.

20. The method of claim 19 , wherein the signature comprises an Intrusion Prevention System (IPS) signature.

21. The method of claim 19 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN.

22. The method of claim 19 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN, and wherein the NXDOMAIN response includes a destination IP address that corresponds to the host device.

23. The method of claim 19 , wherein a plurality of NXDOMAIN responses are received at the security device, and wherein one or more distinct host devices are determined based on distinct IP addresses associated with one or more of the plurality of NXDOMAIN responses received at the security device.

24. The method of claim 19 , wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

determining whether a threshold number of NXDOMAIN responses is received at the security device.

25. The method of claim 19 , wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

determining whether a threshold number of NXDOMAIN responses is received at the security device within a predetermined period of time.

26. The method of claim 19 , further comprising:

determining that a first domain name is a DGA generated domain name based on detected DGA behavior using the signature, wherein the first domain name is associated with at least one of the one or more of the plurality of NXDOMAIN responses.

27. The method of claim 19 , further comprising:

sinkholing the first domain name using a sinkholed IP address.

28. The method of claim 19 , further comprising:

sinkholing the first domain name using the security device to redirect any host device that attempts to connect to the first domain name to a sinkholed IP address.

29. The method of claim 19 , further comprising:

sinkholing the first domain name using the security device to redirect any host device that attempts to connect to the first domain name to a sinkholed IP address, wherein the sinkholed IP address is associated with the security device.

30. The method of claim 19 , further comprising:

31. The method of claim 19 , further comprising:

32. The method of claim 19 , further comprising:

sinkholing the first domain name using a sinkholed IP address; and

monitoring network activity redirected to the sinkholed IP address.

33. The method of claim 19 , further comprising:

sinkholing the first domain name using a sinkholed IP address; and

identifying a first host device that is infected with malware based on an attempt by the first host device to connect to the first domain name, wherein the first host device is redirected to the sinkholed IP address in response to the attempt by the first host device to connect to the first domain name.

34. The method of claim 19 , further comprising:

sinkholing the first domain name using a sinkholed IP address; and

generating a log for each attempted host device connection that is redirected to the sinkholed IP address.

35. The method of claim 19 , further comprising:

sinkholing the first domain name using a sinkholed IP address; and

reporting one or more host devices that attempt to connect to the sinkholed IP address.

36. The method of claim 19 , further comprising:

determining one or more host devices that attempted to connect to the first domain name; and

performing an action in response to determining the one or more host devices that attempted to connect to the first domain name.

37. A computer program product for Domain Generation Algorithm (DGA) behavior detection, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses; and

applying a signature to the passive DNS data to detect DGA behavior, wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response, comprises:

in response to a determination that the DNS response corresponds to an NXDOMAIN response:

calculating an entropy of a host name in the DNS response using Shannon entropy;

determining whether the entropy satisfies a predetermined threshold; and

in response to a determination that the entropy fails to satisfy the predetermined threshold, disregarding the DNS response.

38. The computer program product recited in claim 37 , wherein the signature comprises an Intrusion Prevention (IPS) signature.

39. The computer program product recited in claim 37 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN.

40. The computer program product recited in claim 37 , wherein the NXDOMAIN response is in response to a DNS query from a host device for an NXDOMAIN, and wherein the NXDOMAIN response includes a destination IP address that corresponds to the host device.

41. The computer program product recited in claim 37 , wherein a plurality of NXDOMAIN responses are received at the security device, and wherein one or more distinct host devices are determined based on distinct IP addresses associated with one or more of the plurality of NXDOMAIN responses received at the security device.

42. The computer program product recited in claim 37 , wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

determining whether a threshold number of NXDOMAIN responses is received at the security device.

43. The computer program product recited in claim 37 , wherein applying the signature to the passive DNS data to detect DGA behavior further comprises:

determining whether a threshold number of NXDOMAIN responses is received at the security device within a predetermined period of time.

44. The computer program product recited in claim 37 , further comprising computer instructions for:

45. The computer program product recited in claim 37 , further comprising computer instructions for:

determining that a first domain name is DGA generated domain name based on detected DGA behavior using the signature, wherein the first domain name is associated with at least one of the one or more of the plurality of NXDOMAIN responses; and

sinkholing the first domain name using a sinkholed IP address.

46. The computer product recited in claim 37 , further comprising computer instructions for:

sinkholing the first domain name using the security device to redirect any host device that attempts to connect to the first domain name to a sinkholed IP address.

47. The computer program product recited in claim 37 , further comprising computer instructions for:

48. The computer program product recited in claim 37 , further comprising computer instructions for:

49. The computer program product recited in claim 37 , further comprising computer instructions for:

50. The computer program product recited in claim 37 , further comprising computer instructions for:

sinkholing the first domain name using a sinkholed IP address; and

monitoring network activity redirected to the sinkholed IP address.

51. The computer program product recited in claim 37 , further comprising computer instructions for:

sinkholing the first domain name using a sinkholed IP address; and

52. The computer program product recited in claim 37 , further comprising computer instructions for:

sinkholing the first domain name using a sinkholed IP address; and

generating a log for each attempted host device connection that is redirected to the sinkholed IP address.

53.

The computer program product recited in claim 37 , further comprising computer instructions for:

sinkholing the first domain name using a sinkholed IP address; and

reporting one or more host devices that attempt to connect to the sinkholed IP address.

54. The computer program product recited in claim 37 , further comprising computer instructions for:

determining one or more host devices that attempted to connect to the first domain name; and

performing an action in response to determining the one or more host devices that attempted to connect to the first domain name.

Continuity (2)

Continuation 14754489 · Jun 29, 2015

Related Publication 20180262520A1 · Sep 13, 2018