CROSS-REFERENCE TO RELATED APPLICATIONS
This application is based on and derives the benefit of the filing date of U.S. Provisional Patent Application No. 61/087,873, filed Aug. 11, 2008. The entire content of this application is herein incorporated by reference in its entirety.
BRIEF DESCRIPTION OF THE FIGURES
DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION
The sampler 125 can sample DNS traffic between the monitored network 105 and the RDNS server 115 for further processing, according to one embodiment. The sampler 125 can sample DNS queries and their related responses according to a probability p. For example, assuming p=0.2, each DNS query and its response has a 20% chance to be included in the sample. The value of p can be varied in order to alter the desired sample-size.
The filter 130 can filter DNS traffic for further processing, according to one embodiment. For each domain name d that is in the sample of DNS traffic selected by the sampler 125, the filter 130 can determine whether to discard that domain name or accept it for further processing. According to one embodiment, the filter 130 can extract from domain d its top level domain (TLD(d)) and its second level domain (2LD(d)). Thus, for example, if d=domain.example.com, then TLD(d)=com, and 2LD(d)=example.com. The filter 130 can then check to see if TLD(d) or 2LD(d) are contained in certain lists of top level domains and second level domains. For example, 2LD(d) can be checked against a whitelist of known and legitimate second level domains. Additionally, TLD(d) can be checked against a list of suspicious top level domains. Furthermore, 2LD(d) can be checked against a list of dynamic DNS second level domain names, and then can be checked against another list of newly created second level domains. The filter 130 can then use the results of these queries to determine whether to discard domain name d or to accept it for further processing.
The statistics collector 135 can collect statistics about domain names that have been accepted for further processing by the filter 130, according to one embodiment. The statistics collector 135 can monitor these domain names over a period of time T. For example, if T=1 day, the statistics collector 135 can monitor each domain name for a period of one day. The statistics collector 135 can collect information about each domain name d over period T, such as, but not limited to: the number of queries to domain d observed during T, the number of distinct resolved IP addresses during T for the domain d, and the number of distinct source IP addresses that queried d during time T; the maximum number of queries for a certain domain issued by a single source IP address in any given subinterval Ti<T; the number of error messages received as a response to queries to a certain domain name; the number of NX domain (non-existent domain) responses; and the entire set of source IP address and resolved IP addresses extracted from the DNS queries and related responses.
The statistics database 140 can store the data that the statistics collector 135 gathered, according to one embodiment. For example, a relational database can be used to store this data. A relational database can be a structured collection of data that uses tables comprised of rows and columns to store the desired information.
The ranker 145 can rank domain names based on their suspiciousness and can accept some domain names for further processing, according to one embodiment. The ranker 145 can retrieve statistics from the statistics database 140. The ranker 145 can then calculate a suspiciousness score for each domain name d over a period of time T. For example, the ranker 145 can calculate a suspiciousness score as a ratio of the number of queries to domain d observed during T to the number of distinct source IP addresses that queried domain d during time T. The ranker 145 can rank each domain name based on its suspiciousness score. The ranker can then discard domain names with low suspiciousness scores and accept domain names with high suspiciousness scores for further processing. For example, the ranker 145 can compare each domain name's suspiciousness score to a provided threshold I in order to determine if it should be discarded or accepted for further processing.
The information searcher 150 can search for further information about the domain names that were accepted for further processing by the ranker 145, according to one embodiment. The information searcher 150 can use Internet search engines to search for a given domain name d, and the top n results of each Internet search can then be collected. For example, if n=10, the top 10 search results will be collected. If any of the top n results contains a link to a known malware analysis website, then the contents of that linked page can also be collected. The information searcher 150 can also conduct reverse DNS lookups for each resolved IP address for a given domain name d. The information searcher 150 can also perform a mapping between each resolved IP address for a given domain name d and the Autonomous System (AS) that it belongs to. An autonomous system can be a set of IP addresses under the control of one network operator or organization that has a clearly defined routing policy to the Internet. An AS is uniquely identified by an AS number and an AS name.
The classifier 155 can classify domain names into categories, such as, but not limited to: malicious, suspicious, or legitimate, according to one embodiment. The malicious category can include domain names that are clearly malware-related and likely to be botnet-related. The suspicious category can represent domain names that are likely to be malware-related, but for which further analysis is required. Finally, the legitimate category can represent domain names that are not related to any suspicious activity. The classifier can classify each domain name by examining: the domain name, a set of resolved IP addresses for that domain name, the statistics for that domain name collected by statistics collector 135 and stored by statistics database 140, the Internet search results gathered by the information searcher 150, a list of known malicious IP addresses and autonomous systems, a database of domain names from a malware analysis tool, a query volume threshold and a list of known malware analysis websites.
Referring again to
In 415, a set of top level domains, which can be referred to as a Suspicious TLDs set, can be checked to see if it contains TLD(d). The Suspicious TLDs set can contain top level domains that are often associated with malicious and botnet-related domain names (for example: .biz, .info, etc.). If TLD(d) does not appear in the Suspicious TLDs set, then further filtration of d continues. If TLD(d) appears in the Suspicious TLDs set, then d is accepted for further processing in 430. Thus, the full domain name d, or any part of the domain name d can then be further investigated.
In 420, a set of second level domain names, referred to as the Dynamic DNS (DDNS) 2LDs set, can be checked to see if it contains 2LD(d). The DDNS 2LDs set can contain second level domain names owned by Dynamic DNS service providers that may be suspicious (for example: dyndns.org, no-ip.com, yi.org, etc.). If 2LD(d) does not appear in the DDNS 2LDs set, then further filtration of d continues. If 2LD(d) appears in the DDNS 2LDs set, then d is accepted for further processing in 430.
In 425, a set of second level domain names, which can be referred to as New 2LDs set, can be checked to see if it contains 2LD(d). The New 2LDs set can contain second level domains that have never been queried during a previous period of time. For example, if the second level domain “example.com” had not been queried in the previous week, it could be included in the New 2LDs set. If 2LD(d) does not appear in the New 2LDs set, then d is discarded in 435. If 2LD(d) appears in the New 2LDs set, then d is accepted for further processing in 430.
As discussed above, a domain d can be accepted for further processing in 430. In 435, a domain d that has been filtered out by one of the steps 410, 415, 420 or 425 can be discarded, and will not undergo further processing. In 440, the filtration method of
In 510, a reverse DNS lookup can be performed for each IP address that resolved for domain name d. Previously in 220 in
In 515, a mapping is performed between each resolved IP address r and the Autonomous System (AS) it belongs to. Given an IP address, the AS number and the AS name to which the IP address belongs can be retrieved using information publicly available on the Internet.
In 605, the input parameters can include, but are not limited to: domain name d, a set of resolved IP addresses R, domain statistics S (as compiled and stored in 215 and 220 on
In 610, Internet search results G can be checked to see if they contain a link to a malware analysis website using W. If G contains a link to a malware analysis website listed in W, then d can be classified as malicious in 620. For example, if W contained known malware analysis website avira.com, and if Internet search results G contain a link to avira.com, then d can be classified as malicious. If G does not contain a link to any known malware analysis website in W, then further classification of d continues. Thus, for example, if the only known malware analysis website in W is avira.com, and Internet search results G do not contain a link to avira.com then d could be further classified in another step.
In 615, if the Internet search results G are determined to be empty, and if the database of domain names from malware analysis tool M contains the domain name d, then d can be classified as malicious in 620. Otherwise, further classification of d can continue. For example, if d=example.com, and if Internet search results G are empty, and if the database of domain names from malware analysis tools M contains “example.com,” then d can be classified as malicious. However, by way of another example, if G is not empty or if M does not contain “example.com” then further classification of d can continue.
In 625, it can be determined whether any of the resolved IP addresses R or their related Autonomous System (AS) numbers are in the list of known malicious IP addresses and autonomous systems A. If the resolved IP addresses or their related AS numbers are found to be in A, then d can be classified as suspicious in 645. Otherwise, further classification of d can continue. For example, if resolved IP addresses R contains IP address “123.123.123.123” and A also contains “123.123.123.123,” then d could be classified as suspicious. However, if A does not contain any of the IP addresses in R or their related AS numbers, then further classification of d could continue.
In 635, Internet search results G can be checked to see if the result is empty. For example, this criteria would be satisfied if the Internet search results G did not contain any data. On the other hand, by way of example, this criteria would not be satisfied if Internet search results G did contain some search results. Additionally, R can be checked to see if it contains at least one IP address that is a home-user address in 635. For example, this criteria could be satisfied if IP address “123.123.123.123” was known to be a home-user address and the set of resolved IP addresses R contained “123.123.123.123”. On the other hand, by way of example, this criteria would not be satisfied if R did not contain “123.123.123.123.” Additionally, the query volume for d can be checked to see if it is higher than a provided query volume threshold t in 635. For example, the query volume threshold t can be set to 1,000 queries. In this example, if the query volume for d was 2,000 queries, the query volume 2,000 is greater than the threshold 1,000, and accordingly this criteria would be satisfied. However, if the query volume for d was 500 queries, the query volume of 500 would be less than the threshold of 1,000, and accordingly the criteria would not be satisfied. If all of three criteria are satisfied, then the domain name d can be classified as suspicious in 645. Otherwise, d can be classified as legitimate in 640.
While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example, and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the spirit and scope of the present invention. Thus, the present invention should not be limited by any of the above-described exemplary embodiments.
In addition, it should be understood that the figures described above, which highlight the functionality and advantages of the present invention, are presented for example purposes only. The architecture of the present invention is sufficiently flexible and configurable, such that it may be utilized in ways other than that shown in the figures.
Further, the purpose of the Abstract of the Disclosure is to enable the U.S. Patent and Trademark Office and the public generally, and especially the scientists, engineers and practitioners in the art who are not familiar with patent or legal terms or phraseology, to determine quickly from a cursory inspection the nature and essence of the technical disclosure of the application. The Abstract of the Disclosure is not intended to be limiting as to the scope of the present invention in any way.