SYSTEM AND METHOD TO DETECT DOMAIN GENERATION ALGORITHM MALWARE AND SYSTEMS INFECTED BY SUCH MALWARE

摘要

Systems and methods for detection of domain generated algorithms (DGA) and their command and control (C&C) servers are disclosed. In one embodiment, such an approach includes examining DNS queries for DNS resolution failures, and monitoring certain set of parameters such as number of levels, length of domain name, lexical complexity, and the like for each failed domain. These parameters may then be compared against certain thresholds to determine if the domain name is likely to be part of a DGA malware. Domain names identified as being part of a DGA malware may then be grouped together. Once a DGA domain name has been identified, activity from that domain name can be monitored to detect successful resolutions from the same source to see if any of the successful domain resolutions match these parameters. If they match specific thresholds, then the domain is determined to be a C&C server of the DGA malware and may be identified as such.

主权项

1. At least one computer readable medium on which are stored instructions comprising instructions that when executed cause a programmable device to:
identify a domain name by monitoring network activity; identify a portion of the domain name as a name; calculate a lexical complexity score for the name; and determine if the domain name is Doman Generated Algorithm (DGA) generated based on at least the lexical complexity score.