Determining potentially malware generated domain names

Patent metadata

Field	Value
Publication number	US-10880319-B2
Application number	US-201815963336-A
Country	US
Kind code	B2
Filing date	Apr 26, 2018
Priority date	Apr 26, 2018
Publication date	Dec 29, 2020
Grant date	Dec 29, 2020

Abstract

In some examples, a Domain Name System (DNS) server is to receive, over a network, a DNS query containing a domain name, the DNS query sent by a device. The DNS server is to determine whether the domain name is potentially generated by malware. In response to determining that the domain name is potentially generated by malware, the DNS server is to generate a DNS response containing information indicating that the domain name is potentially generated by malware, and send the DNS response to the network.

First claim

What is claimed is:

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a Domain Name System (DNS) server to:
receive, over a network, a first DNS query containing a first domain name, the first DNS query sent by a first device;
determine whether the first domain name is potentially generated by malware;
in response to determining that the first domain name is potentially generated by malware:
generate a first DNS response containing information indicating that the first domain name is potentially generated by malware, the first DNS response being responsive to the first DNS query, and
send the first DNS response to the network;

receive, over the network, a second DNS query containing a second domain name, the second DNS query sent by a second device;
determine whether the second domain name is potentially generated by malware; and
in response to determining that the second domain name is not potentially generated by malware:
access mapping information to retrieve a network address corresponding to the second domain name, and
send a second DNS response containing the network address over the network to the second device.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the DNS server is part of a hierarchy of DNS servers.

3. The non-transitory machine-readable storage medium of claim 2 , wherein the DNS server is at a first level of the hierarchy of DNS servers, the DNS server at the first level of the hierarchy of DNS servers to directly receive the first DNS query sent by the first device.

4. The non-transitory machine-readable storage medium of claim 2 , wherein the DNS server is in a level of the hierarchy of DNS servers higher than a first level of the hierarchy of DNS servers, and wherein the first DNS query is received by the DNS server from another DNS server in the first level of the hierarchy of DNS servers.

5. The non-transitory machine-readable storage medium of claim 1 , wherein the information indicating that the first domain name is potentially generated by malware is included in a field of a header of the first DNS response.

6. The non-transitory machine-readable storage medium of claim 1 , wherein the first DNS response is without a network address corresponding to the first domain name.

7. The non-transitory machine-readable storage medium of claim 6 , wherein the first DNS response further contains an indication that the first domain name does not exist.

8. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the DNS server to:
identify a first subset of domain names that are potentially generated by malware;
identify a second subset of domain names that are not potentially generated by malware;
determine whether a value based on a number of DNS queries containing the domain names in the first subset and generated by the first device within a time window has a specified relationship with a threshold; and
identify the first device as a malware-infected device in response to the value having the specified relationship with the threshold.

9. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions upon execution cause the DNS server to:
perform a remediation action with respect to the malware-infected device.

10. The non-transitory machine-readable storage medium of claim 9 , wherein the remediation action is selected from among: blocking the malware-infected device from accessing the network, disabling the malware-infected device, performing a malware cleaning process on the malware-infected device, and blocking processing of a subsequent DNS query from the malware-infected device.

11. A Domain Name System (DNS) server comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
receive, over a network, a DNS query containing a domain name, the DNS query sent by a device;
determine whether the domain name is potentially generated by malware;
in response to determining that the domain name is not potentially generated by malware, include, in a first DNS response, a network address corresponding to the domain name; and

in response to determining that the domain name is potentially generated by malware, include, in a second DNS response, information indicating that the domain name is potentially generated by malware, wherein the DNS server is part of a higher level of a hierarchy of DNS servers, the higher level higher than a first level of the hierarchy of DNS servers, the first level including a DNS server to directly receive the DNS query from the device over the network, and the DNS server in the higher level to receive the DNS query from the DNS server in the first level responsive to the DNS server in the first level determining that the domain name is not within a cache of the DNS server in the first level.

12. The DNS server of claim 11 , wherein the second DNS response including the information indicating that the domain name is potentially generated by malware does not include the network address corresponding to the domain name.

13. The DNS server of claim 11 , wherein the instructions are executable on the processor to:
in response to determining that the domain name is not potentially generated by malware, access mapping information to retrieve the network address corresponding to the domain name, the mapping information mapping domain names to respective network addresses.

14. The DNS server of claim 11 , wherein the instructions are executable on the processor to:
identify a first subset of domain names that are potentially generated by malware;
identify a second subset of domain names that are not potentially generated by malware;
determine whether a value based on a number of DNS queries containing the domain names in the first subset and generated by the device within a time window has a specified relationship with a threshold;
identify the device as a malware-infected device in response to the value having the specified relationship with the threshold; and
perform a remediation action with respect to the malware-infected device.

15. A method comprising:
receiving, by a Domain Name System (DNS) server comprising a processor, over a network, DNS queries containing domain names, the DNS queries sent by a device;
determining, by the DNS server, a first subset of the domain names that are potentially generated by malware;
determining, by the DNS server, a second subset of the domain names that are not potentially generated by malware;
for a first domain name in the first subset of the domain names:
generating, by the DNS server, a DNS response containing information indicating that the first domain name is potentially generated by malware, and information indicating that the first domain name does not exist, and
sending, by the DNS server, the DNS response to the device over the network;

determining, by the DNS server, whether a value based on a number of DNS queries containing domain names in the first subset of the domain names and generated by the device within a time window has a specified relationship with a threshold;
identifying, by the DNS server, the device as a malware-infected device in response to the value having the specified relationship with the threshold; and
performing, by the DNS server, a remediation action with respect to the malware-infected device.

16. The method of claim 15 , further comprising:
performing a remediation action against a subsequent DNS query that contains the first do

Assignees

• Entit Software Llc
• Micro Focus Llc

Inventors

• Arlitt Martin
• Manadhata Pratyusa K

Classifications

• H04L61/4552

  Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title