System and method to detect domain generation algorithm malware and systems infected by such malware
US10198579B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Aug 22, 2014 |
| Grant date | Feb 5, 2019 |
| Priority date | — |
| Expiry date | Jan 17, 2036 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/144
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Systems and methods for detection of domain generated algorithms (DGA) and their command and control (C&C) servers are disclosed. In one embodiment, such an approach includes examining DNS queries for DNS resolution failures, and monitoring certain set of parameters such as number of levels, length of domain name, lexical complexity, and the like for each failed domain. These parameters may then be compared against certain thresholds to determine if the domain name is likely to be part of a DGA malware. Domain names identified as being part of a DGA malware may then be grouped together. Once a DGA domain name has been identified, activity from that domain name can be monitored to detect successful resolutions from the same source to see if any of the successful domain resolutions match these parameters. If they match specific thresholds, then the domain is determined to be a C&C server of the DGA malware and may be identified as such.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.