Discovering and selecting candidates for sinkholing of network domains

Patent metadata

Field	Value
Publication number	US-9560072-B1
Application number	US-201514724679-A
Country	US
Kind code	B1
Filing date	May 28, 2015
Priority date	Oct 31, 2013
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

Techniques for discovering and selecting candidates for sinkholing of network domains are provided. In some embodiments, a process for discovering and selecting candidates for sinkholing of network domains includes collecting passive DNS data from a plurality of security devices to discover candidates for sinkholing of domain names; selecting one or more domain names that are most commonly queried by distinct client devices based on the passive DNS data, wherein each of the one or more domain names is not yet registered; and automatically registering each of the one or more domain names with a domain registry to a sinkholed IP address in order to sinkhole each of the one or more domain names.

First claim

What is claimed is:

1. A system for discovering and selecting candidates for sinkholing of network domains, comprising:
a hardware processor configured to:
collect passive DNS data from a plurality of security devices to discover candidates for sinkholing of domain names;
select one or more domain names that are most commonly queried by distinct client devices based on the passive DNS data, wherein each of the one or more domain names is not yet registered, wherein the selecting of the one or more domain names that are most commonly queried comprises to:
rank commonly queried domain names based on number of queries by the distinct client devices; and
select N most commonly queried domain names to obtain the one or more domain names, N being an integer greater than zero;

apply a Domain Generation Algorithm (DGA) filter to remove any DGA generated domain names from the candidates for sinkholing of domain names, wherein the DGA filter includes a plurality of DGA generated domain names based on an emulated analysis of malware, wherein the applying of the DGA filter comprises to:
determine whether a domain name of the one or more domain names has not been queried by at least a threshold number of distinct hosts, the distinct hosts corresponding to unique IP addresses; and
in the event that the domain name of the one or more domain names has not been queried by at least the threshold number of distinct hosts, remove the domain name from the one or more domain names; and

automatically register each of the one or more domain names with a domain registry to a sinkholed IP address in order to sinkhole each of the one or more domain names; and

a memory coupled to the hardware processor and configured to provide the hardware processor with instructions.

2. The system recited in claim 1 , wherein the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs), and wherein each of the DNS responses includes a destination IP address that corresponds to a client device requesting a domain name resulting in an NXDOMAIN DNS response.

3. The system recited in claim 1 , wherein the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs), wherein each of the DNS responses includes a destination IP address that corresponds to a client device requesting a domain name resulting in an NXDOMAIN DNS response, and wherein the distinct client devices are determined based on distinct IP addresses associated with DNS responses provided in the passive DNS data.

4. The system recited in claim 1 , wherein the passive DNS data from the plurality of security devices is collected daily; and wherein the selected one or more domain names are the most commonly queried by distinct client devices based on the passive DNS data over a period of two or more consecutive days.

5. The system recited in claim 1 , wherein the hardware processor is further configured to:
receive a plurality of malware samples; and
execute each of the plurality of malware samples to identify a plurality of DGA generated domain names.

6. The system recited in claim 1 , wherein the hardware processor is further configured to:
determine a first network domain of the one or more domain names is a bad network domain, wherein the bad network domain is determined to be associated with an identified malware, and wherein the bad network domain is sinkholed by registering the bad network domain with a first sinkholed IP address; and
identify a host that is infected with the identified malware based on an attempt by the host to connect to the first sinkholed IP address.

7. The system recited in claim 1 , wherein the hardware processor is further configured to:
receive additional passive DNS data from a third party DNS data source; and
aggregate the additional passive DNS data from the third party DNS data source with the collected passive DNS data from the plurality of security devices for analysis for discovering and selecting candidates for sinkholing of network domains.

8. The system recited in claim 1 , wherein the hardware processor is further configured to:
generate a log for each attempted host connection to the sinkholed IP address.

9. The system recited in claim 1 , wherein the hardware processor is further configured to:
generate a log for each attempted host connection to the sinkholed IP address; and
report a plurality of hosts that attempted to connect to the sinkholed IP address.

10. A method of discovering and selecting candidates for sinkholing of network domains, comprising:
collecting passive DNS data from a plurality of security devices to discover candidates for sinkholing of domain names;
selecting one or more domain names that are most commonly queried by distinct client devices based on the passive DNS data, wherein each of the one or more domain names is not yet registered, wherein the selecting of the one or more domain names that are most commonly queried comprises:
ranking commonly queried domain names based on number of queries by the distinct client devices; and
selecting N most commonly queried domain names to obtain the one or more domain names, N being an integer greater than zero;

applying a Domain Generation Algorithm (DGA) filter to remove any DGA generated domain names from the candidates for sinkholing of domain names, wherein the DGA filter includes a plurality of DGA generated domain names based on an emulated analysis of malware, wherein the applying of the DGA filter comprises:
determining whether a domain name of the one or more domain names has not been queried by at least a threshold number of distinct hosts, the distinct hosts corresponding to unique IP addresses; and
in the event that the domain name of the one or more domain names has not been queried by at least the threshold number of distinct hosts, removing the domain name from the one or more domain names; and

automatically registering each of the one or more domain names with a domain registry to a sinkholed IP address in order to sinkhole each of the one or more domain names.

11. The method of claim 10 , wherein the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs), and wherein each of the DNS responses includes a destination IP address that corresponds to a client device requesting a domain name resulting in an NXDOMAIN DNS response.

12. The method of claim 10 , wherein the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs), wherein each of the DNS responses includes a destination IP address that corresponds to a client device requesting a domain name resulting in an NXDOMAIN DNS response, and wherein the distinct client devices are determined based on distinct IP addresses associated with DNS responses provided in the passive DNS data.

13. The method of claim 10 , wherein the passive DNS data from the plurality of security devices is collected daily; and wherein the selected one or more domain names are the most commonly queried by distinct client devices based on the passive DNS data over a period of two or more consecutive days.

14. A computer program product for discovering and selecting candidates for sinkholing of network domains, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
collecting passive DNS data from a plurality of security devices to discover candidates for sinkholing of domai

Assignees

• Palo Alto Networks Inc

Inventors

• Xu Wei

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L63/1475 Primary

  Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title