Finding domain-generation algorithms by looking at length distribution

Miranda Mowbray; Josiah Hagen

doi:10.1109/ISSREW.2014.20

Finding domain-generation algorithms by looking at length distribution

Miranda Mowbray, Josiah Hagen

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

53 Citations (Scopus)

Abstract

In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from Domain Name Service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.

Original language	English
Title of host publication	Proceedings - IEEE 25th International Symposium on Software Reliability Engineering Workshops, ISSREW 2014
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	395-400
Number of pages	6
ISBN (Electronic)	9781479973774
DOIs	https://doi.org/10.1109/ISSREW.2014.20
Publication status	Published - 3 Nov 2014
Event	25th IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW 2014 - Naples, Italy Duration: 3 Nov 2014 → 6 Nov 2014

Conference

Conference	25th IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW 2014
Country/Territory	Italy
City	Naples
Period	3/11/14 → 6/11/14

Keywords

AGD
Big data
Botnet
DGA
Domain generation algorithm
Domain name service

Access to Document

10.1109/ISSREW.2014.20

Handle.net

Persistent link

Cite this

@inproceedings{530d18f9abce44bd8461887d9e2d14a5,

title = "Finding domain-generation algorithms by looking at length distribution",

abstract = "In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from Domain Name Service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.",

keywords = "AGD, Big data, Botnet, DGA, Domain generation algorithm, Domain name service",

author = "Miranda Mowbray and Josiah Hagen",

year = "2014",

month = nov,

day = "3",

doi = "10.1109/ISSREW.2014.20",

language = "English",

pages = "395--400",

booktitle = "Proceedings - IEEE 25th International Symposium on Software Reliability Engineering Workshops, ISSREW 2014",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "25th IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW 2014 ; Conference date: 03-11-2014 Through 06-11-2014",

}

Mowbray, M & Hagen, J 2014, Finding domain-generation algorithms by looking at length distribution. in Proceedings - IEEE 25th International Symposium on Software Reliability Engineering Workshops, ISSREW 2014., 6983873, Institute of Electrical and Electronics Engineers (IEEE), pp. 395-400, 25th IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW 2014, Naples, Italy, 3/11/14. https://doi.org/10.1109/ISSREW.2014.20

Finding domain-generation algorithms by looking at length distribution. / Mowbray, Miranda; Hagen, Josiah.
Proceedings - IEEE 25th International Symposium on Software Reliability Engineering Workshops, ISSREW 2014. Institute of Electrical and Electronics Engineers (IEEE), 2014. p. 395-400 6983873.

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - Finding domain-generation algorithms by looking at length distribution

AU - Mowbray, Miranda

AU - Hagen, Josiah

PY - 2014/11/3

Y1 - 2014/11/3

N2 - In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from Domain Name Service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.

AB - In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from Domain Name Service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.

KW - AGD

KW - Big data

KW - Botnet

KW - DGA

KW - Domain generation algorithm

KW - Domain name service

UR - http://www.scopus.com/inward/record.url?scp=84922634014&partnerID=8YFLogxK

U2 - 10.1109/ISSREW.2014.20

DO - 10.1109/ISSREW.2014.20

M3 - Conference Contribution (Conference Proceeding)

AN - SCOPUS:84922634014

SP - 395

EP - 400

BT - Proceedings - IEEE 25th International Symposium on Software Reliability Engineering Workshops, ISSREW 2014

PB - Institute of Electrical and Electronics Engineers (IEEE)

T2 - 25th IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW 2014

Y2 - 3 November 2014 through 6 November 2014

ER -

Finding domain-generation algorithms by looking at length distribution

Abstract

Conference

Keywords

Access to Document

Handle.net

Other files and links

Fingerprint

Cite this