How To Detect Domain Generation Algorithm

The logic behind a domain name generation algorithm is quite simple.

How to detect domain generation algorithm. Most botnets employ domain generation algorithms dgas to avoid detection. Domain fluxing is a technique used by botnets and command and control c2 servers to create many domains using a domain generation algorithm dga 7 8. Later that year conficker made dga a lot more famous. Domain generation algorithm dga is used to generate several domain names commonly used for command and control c c servers in malware attacks.

Over the last decade domain generation algorithms dgas have become a popular tool for threat actors to deliver malware as it has become a difficult technique for defenders to counter attacks. As these dgas become more sophisticated and increasingly difficult to detect zvelo s cyber threat intelligence team is recommending heightened awareness as they anticipate this to be a prominent. A domain generation algorithm is a program that is designed to generate domain names in a particular fashion. In order to avoid detection recent botnets such as conficker zeus and cryptolocker apply a technique called domain fluxing or domain name generation algorithms dga in which the infected bot periodically generates and tries to resolve a large number of pseudorandom domain names until one of them is resolved by the dns server.

A domain generating algorithm dga is a program or subroutine that provides malware with new domains on demand or on the fly. Names to randomly generated ones so called domain generation algorithms dga. Part of this is due to how the algorithm is set up and how easy they are to update. Kraken was the first malware family to use a dga in 2008 that we could find.

All dgas are based off of a static and dynamic seed which ensures that the domains are constantly changing. Instead of hard coding the domain or ip address into the malware the malware finds its c c under a domain with a seemingly random name. We showed how the calico enterprise dga machine learning algorithm can detect any present or future apts using dga to connect back to the c2 servers while minimizing false positives. The dga employs technique to frequently change the a command and control server c c domain name in order to hide the.

All botnets and c2 servers in the same infrastructure use the same seeded algorithm such that they all create the same pseudorandomly generated domains. Malicious software coordinated via dgas leaves however a distinctive signature in network traces of high entropy domain names and a variety of algorithms have been introduced to detect certain aspects about currently used dgas. A subset of these domains. Attackers developed dgas so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware usually referred to as command and control or c2.