How To Detect Domain Generation Algorithm

A domain generating algorithm dga is a program or subroutine that provides malware with new domains on demand or on the fly.

How to detect domain generation algorithm. The logic behind a domain name generation algorithm is quite simple. Part of this is due to how the algorithm is set up and how easy they are to update. Instead of hard coding the domain or ip address into the malware the malware finds its c c under a domain with a seemingly random name.

All dgas are based off of a static and dynamic seed which ensures that the domains are constantly changing. As these dgas become more sophisticated and increasingly difficult to detect zvelo s cyber threat intelligence team is recommending heightened awareness as they anticipate this to be a prominent. Over the last decade domain generation algorithms dgas have become a popular tool for threat actors to deliver malware as it has become a difficult technique for defenders to counter attacks.

In addition the dga domain list provided by the algorithm is a valuable asset for any security team enabling them to efficiently mitigate threats while reducing. Names to randomly generated ones so called domain generation algorithms dga. Attackers developed dgas so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware usually referred to as command and control or c2.

Domain generation algorithm dga is used to generate several domain names commonly used for command and control c c servers in malware attacks. Kraken was the first malware family to use a dga in 2008 that we could find. Most botnets employ domain generation algorithms dgas to avoid detection.

A domain generation algorithm is a program that is designed to generate domain names in a particular fashion. Malicious software coordinated via dgas leaves however a distinctive signature in network traces of high entropy domain names and a variety of algorithms have been introduced to detect certain aspects about currently used dgas. All botnets and c2 servers in the same infrastructure use the same seeded algorithm such that they all create the same pseudorandomly generated domains.

Later that year conficker made dga a lot more famous. In order to avoid detection recent botnets such as conficker zeus and cryptolocker apply a technique called domain fluxing or domain name generation algorithms dga in which the infected bot periodically generates and tries to resolve a large number of pseudorandom domain names until one of them is resolved by the dns server. In this paper.