Patent · US Active

DGA behavior detection

US11032297B2 · kind B2 · utility

2Cited by

14References

22Claims

0Family size

Assignee

Palo Alto Networks, Inc. · US

Inventors

Wei Xu · Santa Clara, US
Xin Ouyang · Lo Wu, CN

Key dates

Filing date	May 19, 2020
Grant date	Jun 8, 2021
Priority date	—
Expiry date	May 19, 2040

Classification

Technology area (CPC H)Electricity
CPC primaryH04L2463/144
WIPO fieldDigital communication
WIPO sectorElectrical engineering

Abstract

Techniques for Domain Generation Algorithm (DGA) behavior detection are provided. In some embodiments, a system, process, and/or computer program product for DGA behavior detection includes receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and applying a signature to the passive DNS data to detect DGA behavior, in which applying the signature to the passive DNS data to detect DGA behavior further comprises: parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response.

Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.