How Does Domain Generation Algorithm Work

All dgas are based off of a static and dynamic seed which ensures that the domains are constantly changing.

How does domain generation algorithm work. The program defines a function with the same name generate domain which accepts current year month which influence the domain generation algorithm the function reserves some space on the stack for the domain variable which is 25 bytes long so it can hold the actual. When you enter a domain name in your web browser it first sends a request to a global network of servers that form the domain name system dns. I ve also written a c program that uses the same dga algorithm for generating the domain names which can be seen below. A basic implementation uses 3 specific parts.

Both malware instances spread on various devices and the hacker controlled software should be able to run the algorithm and produce the same values at a given time. In order to form a possible domain name. For a dga to be functional idempotence on domain generation is required. A domain generating algorithm dga is a program or subroutine that provides malware with new domains on demand or on the fly.

Often the current date is. Part of this is due to how the algorithm is set up and how easy they are to update. To understand how domain names actually work we will take a look at what happens when you enter it in your browser. Later that year conficker made dga a lot more famous.

Attackers developed dgas so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware usually referred to as command and control or c2. A domain generation algorithm is a program that is designed to generate domain names in a particular fashion. Kraken was the first malware family to use a dga in 2008 that we could find.