Apparatus and method for detecting malicious domain cluster

Patent metadata

Field	Value
Publication number	US-2016294859-A1
Application number	US-201514735579-A
Country	US
Kind code	A1
Filing date	Jun 10, 2015
Priority date	Mar 30, 2015
Publication date	Oct 6, 2016
Grant date	—

Abstract

An apparatus and method for detecting a malicious domain cluster. The apparatus for detecting a malicious domain cluster includes a domain name server (DNS) data collection unit and a malicious domain cluster detection unit. The DNS data collection unit collects DNS traffic over a network, and stores the DNS traffic in a database. The malicious domain cluster detection unit generates a domain cluster based on the DNS data, learns the characteristics of normal and malicious clusters in the domain cluster, and detects whether the domain cluster is malicious based on the result of the learning.

First claim

What is claimed is:

1 . An apparatus for detecting a malicious domain cluster, comprising:
a domain name server (DNS) data collection unit configured to collect DNS traffic over a network and store the DNS traffic in a database; and a malicious domain cluster detection unit configured to generate a domain cluster based on the DNS data, learn characteristics of normal and malicious clusters in the domain cluster, and detect whether the domain cluster is malicious based on a result of the learning.

2 . The apparatus of claim 1 , wherein the malicious domain cluster detection unit is configured to comprise:
a clustering module unit configured to generate the domain cluster by grouping domains, exhibiting group activities, into the domain cluster based on the DNS data; a labeling module unit configured to assign a malicious or normal cluster label to the generated domain cluster; a characteristic extraction module unit configured to extract a cluster characteristic different with respect to the malicious and normal clusters based on the generated domain cluster; a learning module unit configured to learn the malicious and normal clusters based on the cluster label and the cluster characteristic; and a detection module unit configured to detect whether the domain cluster is malicious based on a result of the learning of the learning module unit.

3 . The apparatus of claim 2 , wherein in order to group the domains, exhibiting group activities, into the domain cluster, the clustering module unit is configured to represent each of the domains in a form of a list of IP addresses of hosts that have queried the corresponding domain for a specific period, calculate similarities of host IP address lists of the domains, and group domains having similar host IP address lists into a cluster.

4 . The apparatus of claim 2 , wherein the labeling module unit is configured to assign a cluster label to the domain cluster based on the domain label and a cluster classification criterion.

5 . The apparatus of claim 4 , wherein in order to assign the cluster label, the labeling module unit is configured to check whether the domains of the domain cluster are malicious based on domain labels via an external domain evaluation service.

6 . The apparatus of claim 5 , wherein the labeling module unit is configured to consider a corresponding domain to be a malicious domain if the domain label is indicative of danger and consider a corresponding domain to be a normal domain if the domain label is indicative of safety.

7 . The apparatus of claim 4 , wherein the labeling module unit is configured to determine, a cluster classification criterion defining that the domain cluster is a malicious cluster to be satisfied if a specific percentage or more of the domains of the domain cluster are malicious domains and then assign a corresponding cluster label to the domain cluster.

8 . The apparatus of claim 4 , wherein the labeling module unit is configured to determine a cluster classification criterion defining that the cluster domain is a malicious cluster if a preset minimum or larger number of malicious domains are included in the domains of the domain cluster and a normal domain is not present to be satisfied and then assign a corresponding cluster label to the domain cluster.

9 . The apparatus of claim 4 , wherein the labeling module unit is configured to determine a cluster classification criterion defining that the cluster domain is a normal cluster if a specific percentage or more of the domains of the domain cluster are normal domains to be satisfied and then assign a corresponding cluster label to the domain cluster.

10 . The apparatus of claim 4 , wherein the labeling module unit is configured to determine a cluster classification criterion defining that the domain cluster is a normal cluster if a preset minimum or large number of normal domains are included in the domains of the domain cluster and a malicious domain is not present to be satisfied and then assign a corresponding cluster label to the domain cluster.

11 . The apparatus of claim 2 , wherein the characteristic extraction module unit comprises:
a domain age extraction module unit configured to extract an average of domain ages within the domain cluster and a standard deviation of the domain ages as a characteristic item; a domain popularity extraction module unit configured to extract an average of domain popularities within the domain cluster and a standard deviation of the domain popularities as a characteristic item; a resolved IP address extraction module unit configured to extract resolved IP addresses of the domains of the domain cluster as a characteristic item; and a domain link extraction module unit configured to extract an average of web page links indicative of the domains of the domain cluster and a standard deviation of the web page links as a characteristic item.

12 . The apparatus of claim 2 , wherein the learning module unit is configured to update a rule for detection of a malicious domain cluster by continuously learning a newly generated domain cluster.

13 . The apparatus of claim 1 , wherein the DNS data collection unit is configured to extract only DNS traffic data from network traffic and store only DNS data obtained by processing the DNS traffic data in the database.

14 . The apparatus of claim 13 , wherein the DNS data comprises times at which a domain query and response are made, a hash value anonymously generated using a client IP address used to query a domain, a queried domain name, a domain response type, a domain response value, and a time to live (TTL) value of the domain.

15 . A method of detecting a malicious domain cluster, comprising:
collecting, by a DNS data collection unit, DNS traffic over a network and storing, by the DNS data collection unit, processed DNS data in a database; generating, by a malicious domain cluster detection unit, a domain cluster based on the DNS data; learning, by the malicious domain cluster detection unit, characteristics of normal and malicious clusters in the domain cluster; and detecting, by the malicious domain cluster detection unit, whether the domain cluster is malicious based on a result of the learning.

16 . The method of claim 15 , further comprising, between generating the domain cluster and learning the characteristics:
assigning, by the malicious domain cluster detection unit, a malicious or normal cluster label to the generated domain cluster; and extracting, by the malicious domain cluster detection unit, a cluster characteristic different with respect to the malicious and normal clusters based on the generated domain cluster; wherein learning the characteristics comprises learning the malicious and normal clusters based on the cluster label and the cluster characteristic.

17 . The method of claim 16 , wherein assigning the cluster label comprises:
checking whether domains within the domain cluster are malicious based on domain labels via an external domain evaluation service; and assigning the cluster label to the domain cluster based on the domain labels and a cluster classification criterion.

18 . The method of claim 17 , wherein assigning the cluster label comprises assigning a malicious cluster label corresponding to a malicious cluster to the domain cluster if a specific percentage or more of the domains of the domain cluster are malicious domains or if a preset minimum or large number of malicious domains are included in the domains of the domain cluster and a normal domain is not presen

Assignees

• Electronics & Telecommunications Res Inst

Inventors

• Choi Changho
• Kang Brent Byunghoon
• Lee Sungryoul
• Kang Jungmin

Classifications

• H04L61/6068

  Electricity · mapped topic

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06N99/005

  Physics · mapped topic

• G06F17/30598

  Physics · mapped topic

• H04L61/1511

  Electricity · mapped topic