Classification of malware generated domain names

Patent metadata

Field	Value
Publication number	US-9602525-B2
Application number	US-201514633805-A
Country	US
Kind code	B2
Filing date	Feb 27, 2015
Priority date	Feb 27, 2015
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

Techniques are presented herein that combine a host-based analysis of an executable file on a host computer with a network-based analysis, i.e., an analysis of domain names to detect malware generated domain names that are used by the malicious executable files to establish malicious network connections. A server receives information from a host computer about an executable file that, when executed on the host computer, initiates a network connection. The server also receives information about the network connection itself. The server analyzes the information about the executable file to determine whether the executable file has a malicious disposition. Depending on a disposition of the executable file, the server analyzes the information about the network connection and determines whether the network connection is malicious.

First claim

What is claimed is:

1. A method comprising:
receiving information about an executable file residing on a host computer that, when executed on the host computer, initiates a network connection;
receiving information about the network connection, including a domain name included in network traffic associated with the network connection;
analyzing the information about the executable file to determine whether the executable file has an unknown disposition;
upon determining that the executable file has the unknown disposition, analyzing the information about the network connection to determine whether the network connection is malicious based on whether the domain name is generated by a domain generation algorithm; and
classifying the network connection as being malicious when it is determined that the domain name is generated by the domain generation algorithm.

2. The method of claim 1 , wherein the information about the executable file includes at least one of a file name, a file size, and a hash value and analyzing the information about the executable file comprises:
classifying the executable file as being safe, malicious or unknown.

3. The method of claim 1 , further comprising:
forwarding classification information about the network connection to a user interface.

4. The method of claim 1 , wherein determining that the domain name is generated by a domain name generation algorithm includes:
extracting the domain name from the network traffic associated with the network connection;
upon determining that a length of domain name is beyond a predetermined threshold value, calculating a randomness score for the domain name; and
upon determining that the randomness score is beyond a predetermined randomness threshold, classifying the network connection as being malicious.

5. The method of claim 4 , wherein calculating the randomness score includes:
calculating a frequency distribution of characters in the domain name by calculating probability scores for each of a plurality of combinations of characters in the domain name, wherein each of the plurality of the combinations comprises a different number of characters; and
combining the probability scores to generate the randomness score.

6. The method of claim 1 , further comprising:
comparing the domain name with entries in a database; and
classifying the domain name as being safe upon determining that the domain name is in the database.

7. One or more non-transitory computer readable storage media encoded with software comprising executable instructions and when the software is executed operable to:
receive information about an executable file residing on a host computer, that when executed on the host computer, initiates a network connection;
receive information about the network connection, including a domain name included in network traffic associated with the network connection;
analyze the information about the executable file to determine whether the executable file has an unknown disposition;
upon determining that the executable file has the unknown disposition, analyze the information about the network connection to determine whether the network connection is malicious based on whether the domain name is generated by a domain generation algorithm; and
classify the network connection as being malicious when it is determined that the domain name is generated by the domain generation algorithm.

8. The computer readable storage media of claim 7 , wherein the information about the executable file includes at least one of a file name, a file size, and a hash value and the instructions operable to analyze the information about the executable file comprise instructions operable to:
classify the executable file as being safe, malicious or unknown.

9. The computer readable storage media of claim 7 , further comprising instructions operable to:
forward classification information about the network connection to a user interface.

10. The computer readable storage media of claim 7 , wherein the instructions to determine that the domain is generated by a domain generation algorithm include instructions operable to:
extract the domain name from the network traffic associated with the network connection;
upon determination that a length of the domain name is beyond a predetermined threshold, calculate a randomness score for the domain name; and
upon determination that the randomness score is beyond a predetermined randomness threshold, classify the network connection as being malicious.

11. The computer readable storage media of claim 10 , wherein the instructions operable to calculate the randomness score include instructions operable to:
calculate a frequency distribution of characters in the domain name by calculating probability scores for each of a plurality of combinations of characters in the domain name, wherein each of the plurality of the combinations comprises a different number of characters; and
combine the probability scores to generate the randomness score.

12. The computer readable storage media of claim 7 , further comprising instructions operable to:
compare the domain name with entries in a database; and
classify the domain name as being safe upon determining that the domain name is in the database.

13. An apparatus comprising:
one or more network interface devices that enable network communication;
a memory; and
a processor coupled to the one or more network interface devices and to the memory, wherein the processor is configured to:
receive information about an executable file residing on a host computer that, when executed on the host computer initiates a network connection;
receive information about the network connection, including a domain name included in network traffic associated with the network connection;
analyze the information about the executable file to determine whether the executable file has an unknown disposition;
upon determining that the executable file has the unknown disposition, analyze the information about the network connection to determine whether the network connection is malicious based on whether the domain name is generated by a domain generation algorithm; and
classify the network connection as being malicious when it is determined that the domain name is generated by the domain generation algorithm.

14. The apparatus of claim 13 , wherein the information about the executable file includes at least one of a file name, a file size, and a hash value and the processor is further configured to:
classify the executable file as being safe, malicious or unknown.

15. The apparatus of claim 13 , wherein the processor is configured to:
forward classification information about the network connection to a user interface.

16. The apparatus of claim 13 , wherein the processor is configured to determine that the domain name is generated by a domain name generation algorithm by:
extracting the domain name from the network traffic associated with the network connection;
upon determining that a length of the domain name is beyond a predetermined threshold value, calculate a randomness score for the domain name; and
upon determining that the randomness score is beyond a predetermined randomness threshold, classify the network connection as being malicious.

17. The apparatus of claim 16 , wherein when the processor is configured to calculate the randomness score value by:
calculating a frequency distribution of characters in the domain name by calculating probability scores for each of a plurality of combinations of characters in the domain

Assignees

• Cisco Tech Inc

Inventors

• Qian Jiang
• O'Donnell Adam J
• Frank Paul
• Mullen Patrick

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title