SG11201803441WA - System and methods for detecting domain generation algorithm (dga) malware - Google Patents

System and methods for detecting domain generation algorithm (dga) malware

Info

Publication number
SG11201803441WA
SG11201803441WA SG11201803441WA SG11201803441WA SG11201803441WA SG 11201803441W A SG11201803441W A SG 11201803441WA SG 11201803441W A SG11201803441W A SG 11201803441WA SG 11201803441W A SG11201803441W A SG 11201803441WA SG 11201803441W A SG11201803441W A SG 11201803441WA
Authority
SG
Singapore
Prior art keywords
dga
malware
methods
generation algorithm
domain generation
Prior art date
Application number
SG11201803441WA
Other languages
English (en)
Inventor
Octavian Mihai Minea
Cristina VATAMANU
Mihai-Razvan Benchea
Dragos-Teodor Gavrilut
Original Assignee
Bitdefender Ipr Man Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bitdefender Ipr Man Ltd filed Critical Bitdefender Ipr Man Ltd
Publication of SG11201803441WA publication Critical patent/SG11201803441WA/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/121—Timestamp
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/144—Detection or countermeasures against botnets

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Debugging And Monitoring (AREA)
  • Storage Device Security (AREA)
SG11201803441WA 2015-11-04 2016-11-02 System and methods for detecting domain generation algorithm (dga) malware SG11201803441WA (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US14/932,765 US9819696B2 (en) 2015-11-04 2015-11-04 Systems and methods for detecting domain generation algorithm (DGA) malware
PCT/EP2016/076343 WO2017076859A1 (en) 2015-11-04 2016-11-02 System and methods for detecting domain generation algorithm (dga) malware

Publications (1)

Publication Number Publication Date
SG11201803441WA true SG11201803441WA (en) 2018-05-30

Family

ID=57286460

Family Applications (1)

Application Number Title Priority Date Filing Date
SG11201803441WA SG11201803441WA (en) 2015-11-04 2016-11-02 System and methods for detecting domain generation algorithm (dga) malware

Country Status (13)

Country Link
US (1) US9819696B2 (ja)
EP (1) EP3371953B1 (ja)
JP (1) JP6726429B2 (ja)
KR (1) KR102271545B1 (ja)
CN (1) CN108353083B (ja)
AU (1) AU2016348500B2 (ja)
CA (1) CA3002605C (ja)
ES (1) ES2880269T3 (ja)
HK (1) HK1254971A1 (ja)
IL (1) IL258776A (ja)
RU (1) RU2726032C2 (ja)
SG (1) SG11201803441WA (ja)
WO (1) WO2017076859A1 (ja)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9979748B2 (en) * 2015-05-27 2018-05-22 Cisco Technology, Inc. Domain classification and routing using lexical and semantic processing
US10728266B2 (en) * 2017-08-15 2020-07-28 Check Point Software Technologies Ltd. Methods and systems for identifying malware enabled by automatically generated domain names
US10979451B2 (en) 2018-02-14 2021-04-13 Cisco Technology, Inc. Autonomous domain generation algorithm (DGA) detector
US11075947B2 (en) * 2018-06-26 2021-07-27 Cisco Technology, Inc. Virtual traffic decoys
US10862854B2 (en) 2019-05-07 2020-12-08 Bitdefender IPR Management Ltd. Systems and methods for using DNS messages to selectively collect computer forensic data
US11729134B2 (en) * 2019-09-30 2023-08-15 Palo Alto Networks, Inc. In-line detection of algorithmically generated domains
KR102265955B1 (ko) * 2019-12-18 2021-06-16 주식회사 쏘마 악성 코드 실행 방지를 위한 악성 코드 탐지 방법 및 도메인 생성 알고리즘 탐지 방법
KR102638308B1 (ko) * 2021-12-21 2024-02-20 주식회사 윈스 ＤＮＳ 트래픽 분석을 통한 자동화 ＤＤｏＳ 감지 방법 및 장치
US12118078B2 (en) * 2022-02-14 2024-10-15 Mellanox Technologies, Ltd. Malicious activity detection in memory of a data processing unit using machine learning detection models
US20230262076A1 (en) * 2022-02-14 2023-08-17 Mellanox Technologies, Ltd. Malicious domain generation algorithm (dga) detection in memory of a data processing unit using machine learning detection models
US11582247B1 (en) * 2022-04-19 2023-02-14 Palo Alto Networks, Inc. Method and system for providing DNS security using process information

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5444780A (en) 1993-07-22 1995-08-22 International Business Machines Corporation Client/server based secure timekeeping system
JPH07175734A (ja) * 1993-12-20 1995-07-14 Ricoh Co Ltd ローカルエリアネットワーク
DE10014522C2 (de) * 2000-03-23 2003-08-21 Siemens Ag Verfahren und Anordnung zur Zulässigkeitsprüfung einer Dienstnutzung
US8327448B2 (en) 2005-06-22 2012-12-04 Intel Corporation Protected clock management based upon a non-trusted persistent time source
US8220031B2 (en) 2007-05-01 2012-07-10 Texas Instruments Incorporated Secure time/date virtualization
US8161160B2 (en) * 2008-02-28 2012-04-17 Microsoft Corporation XML-based web feed for web access of remote resources
US9501644B2 (en) * 2010-03-15 2016-11-22 F-Secure Oyj Malware protection
US8260914B1 (en) * 2010-06-22 2012-09-04 Narus, Inc. Detecting DNS fast-flux anomalies
US8516585B2 (en) 2010-10-01 2013-08-20 Alcatel Lucent System and method for detection of domain-flux botnets and the like
RU103643U1 (ru) * 2010-11-01 2011-04-20 Закрытое акционерное общество "Лаборатория Касперского" Система противодействия фишинг атакам
US9467421B2 (en) * 2011-05-24 2016-10-11 Palo Alto Networks, Inc. Using DNS communications to filter domain names
US9047441B2 (en) * 2011-05-24 2015-06-02 Palo Alto Networks, Inc. Malware analysis system
US8763117B2 (en) 2012-03-02 2014-06-24 Cox Communications, Inc. Systems and methods of DNS grey listing
CN102833337B (zh) * 2012-08-30 2016-03-02 北京星网锐捷网络技术有限公司 一种ftp文件上传、下载方法及装置
US9077546B1 (en) * 2012-11-27 2015-07-07 Symnatec Corporation Two factor validation and security response of SSL certificates
US8990513B2 (en) * 2013-01-11 2015-03-24 International Business Machines Corporation Accelerated recovery for snooped addresses in a coherent attached processor proxy
GB201306628D0 (en) 2013-04-11 2013-05-29 F Secure Oyj Detecting and marking client devices
CN103634315B (zh) * 2013-11-29 2017-11-10 哈尔滨工业大学（威海） 域名服务器的前端控制方法及系统
CN104580185B (zh) * 2014-12-30 2017-12-01 北京工业大学 一种网络访问控制的方法和系统

Also Published As

Publication number Publication date
HK1254971A1 (zh) 2019-08-02
EP3371953B1 (en) 2021-05-12
AU2016348500B2 (en) 2020-04-30
KR20180081053A (ko) 2018-07-13
KR102271545B1 (ko) 2021-07-05
CA3002605C (en) 2022-03-29
RU2018118828A (ru) 2019-12-05
US9819696B2 (en) 2017-11-14
WO2017076859A1 (en) 2017-05-11
CN108353083B (zh) 2021-02-26
EP3371953A1 (en) 2018-09-12
RU2726032C2 (ru) 2020-07-08
CN108353083A (zh) 2018-07-31
ES2880269T3 (es) 2021-11-24
US20170126706A1 (en) 2017-05-04
JP6726429B2 (ja) 2020-07-22
IL258776A (en) 2018-06-28
AU2016348500A1 (en) 2018-05-10
RU2018118828A3 (ja) 2020-03-25
JP2018533793A (ja) 2018-11-15
CA3002605A1 (en) 2017-05-11

Similar Documents

Publication Publication Date Title
HK1254971A1 (zh) 用於檢測域產生算法(dga)惡意軟件的系統及方法
IL252501B (en) Methods and systems for detecting malicious code
HK1252804A1 (zh) 用於基於測序的變型檢測的方法和系統
HK1252103A1 (zh) 用於拷貝數變異檢測的方法和系統
IL250521A0 (en) Method and system for detecting malware
EP3111330A4 (en) System and method for verifying and detecting malware
IL248593A0 (en) System and method for a device detecting and configuring an application
EP3111331A4 (en) Systems and methods for malware detection and mitigation
EP3183843A4 (en) System and method to detect domain generation algorithm malware and systems infected by such malware
EP3132372A4 (en) System and method for cyber threats detection
IL226747A0 (en) A system and method for studying malware detection
IL235423A0 (en) Method and system for mitigating targeted phishing attacks
EP3090375A4 (en) Method and apparatus for malware detection
ZA201606932B (en) System and method for position detection
EP3161713A4 (en) System and method for the tracing and detection of malware
GB201418499D0 (en) Malware detection method
GB201510957D0 (en) Systems and Methods For Verification And Anomaly Detection
EP3196795A4 (en) Malware detection method and apparatus
PL3143418T3 (pl) Sposób i system wykrywania uszkodzeń wirnika
HK1215896A1 (zh) 檢測和防止光攻擊的系統和方法
GB201602437D0 (en) System and/or method for computing interprocedural dominators
HK1211703A1 (en) An inspection device, method and system
SG10201610952XA (en) Technique for detecting malicious electronic messages
GB2543813B (en) Improved malware detection
SG10201403334XA (en) Detection system and method