Patent · US Active

DGA behavior detection

US10812501B2 · kind B2 · utility

0Cited by

14References

54Claims

0Family size

Assignee

Palo Alto Networks, Inc. · US

Inventors

Wei Xu · Santa Clara, US
Xin Ouyang · Lo Wu, CN

Key dates

Filing date	Feb 1, 2018
Grant date	Oct 20, 2020
Priority date	—
Expiry date	Feb 1, 2038

Classification

Technology area (CPC H)Electricity
CPC primaryH04L2463/144
WIPO fieldDigital communication
WIPO sectorElectrical engineering

Abstract

Techniques for Domain Generation Algorithm (DGA) behavior detection are provided. In some embodiments, a system, process, and/or computer program product for DGA behavior detection includes receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and applying a signature to the passive DNS data to detect DGA behavior, in which applying the signature to the passive DNS data to detect DGA behavior further comprises: parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response.

Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.