Patent · US Active

DGA behavior detection

US9917852B1 · kind B1 · utility

67Cited by

5References

20Claims

0Family size

Assignee

Palo Alto Networks, Inc. · US

Inventors

Wei Xu · Santa Clara, US
Xin Ouyang · Lo Wu, CN

Key dates

Filing date	Jun 29, 2015
Grant date	Mar 13, 2018
Priority date	—
Expiry date	Feb 7, 2036

Classification

Technology area (CPC H)Electricity
CPC primaryH04L2463/144
WIPO fieldDigital communication
WIPO sectorElectrical engineering

Abstract

Techniques for Domain Generation Algorithm (DGA) behavior detection are provided. In some embodiments, a system, process, and/or computer program product for DGA behavior detection includes receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and applying a signature to the passive DNS data to detect DGA behavior, in which applying the signature to the passive DNS data to detect DGA behavior further comprises: parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response.

Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.