METHOD AND SYSTEM FOR DETERMINING WHETHER DOMAIN NAMES ARE LEGITIMATE OR MALICIOUS

[0001] This application claims priority to provisional application 61/372,246, filed on Aug. 10, 2010, the entirety of which is herein incorporated by reference.

[0002] FIG. 1 illustrates a system for detecting whether a domain name is legitimate or malicious, according to an embodiment.

[0003] FIG. 2 illustrates example statistical features, according to an embodiment.

[0004] FIG. 3 illustrates the off-line training mode and the on-line training mode, according to an embodiment.

[0005] FIG. 4(a) illustrates a high level overview of a network profile modeling module, according to an embodiment.

[0006] FIG. 4(b) illustrates network-based clustering, zone-based clustering, and cluster characterization, according to an embodiment.

[0007] FIG. 5 illustrates a method for detecting whether a domain name is legitimate or malicious, according to an embodiment.

[0008] FIG. 6 illustrates network and zone-based clustering, according to an example embodiment.

[0009] FIGS. 7-8 illustrate a method for computing a reputation score, according to an embodiment.

[0010] FIG. 1 illustrates a system 100 for detecting whether a domain name is legitimate or malicious, according to one embodiment. The system 100 may assign reputation scores to domain names. A domain name may comprise a set of substrings separated by a period. The rightmost substring is called the top level domain (TLD). The second level domain (2LD) represents the two rightmost substrings separated by a period; the third level domain (3LD) represents the three rightmost substrings separated by a period. For example, given the domain name a.b.example.com, the TLD is “corn”, the 2LD is “example.com”, and the 3LD is “b.example.com”. Given a domain name, a reputation score (e.g., low) may be assigned to the domain name if the domain name is associated with malicious activities. Another reputation score (e.g., high) may be assigned to the domain name if the domain name is associated with legitimate Internet services.

[0011] System 100 may comprise: a network (e.g., Internet 105), an Internet service provider (ISP) recursive domain name system (rDNS) servers 110 (e.g., one in Atlanta, and one in San Jose), subnets 120, a security information exchange (SIE) 140, a passive domain name system (pDNS) database 125, or a reputation engine 130, or any combination thereof. Historical information about domain names and their resolved IP addresses may be collected, using the Internet 105, from real-world DNS traffic from multiple diverse geographical locations using subnets 120. Each ISP rDNS 110 can collect this historical information (e.g., 30,000 queries per second during peak hours) from various subnets 120 and send this historical information to the pDNS database 125.

[0012] In addition, DNS traffic may also be collected from alternative passive DNS collectors (i.e., SIE) 140, which may aggregate DNS traffic generated by a large number of rDNS servers across large areas (e.g., North America, Europe, etc.). For example, SIE project may process 200 Mb/s of DNS messages, which is several times the total volume of single US ISP.

[0013] In addition to storing the historical information collected by the ISP rDNS 110 and the SIE 140, the pDNS database 125 may also store additional information, such as a list or multiple lists of known malicious domain names. These lists of known malicious domain names may be created or updated by running known malware samples in a controlled environment, and then classifying all the domain names contacted by the malware samples that do not match a pre-compiled white list (e.g., a large list of popular, legitimate domain names from Alexa.com). In addition, domain names, which do not match a pre-compiled white list, may be extracted from spam emails collected using a spam-trap.

[0014] The reputation engine 130 may utilize the information stored in the pDNS database 125 to determine the reputation of new domain names. Additional information about how the reputation engine 130 is utilized is described below.

[0015] FIG. 5 illustrates a method 500 for determining whether at least one domain name is legitimate or malicious, according to an embodiment. In 505, pDNS query information may be obtained. For example, information about the set of IP addresses to which the domain name points may be obtained. Then, the pDNS database 125 may retrieve the related historic IP address (RHIP) information and the related historic domain name (RHDN) information. The RHIP address information may comprise the set of IP addresses ever pointed to by the domain name, the set of IP addresses ever pointed to the 3LD of the domain name, and the set of IP addresses ever pointed to the 2LD of the domain name. The RHDN information may comprise the entire set of domain names that ever resolved to an IP address or any IP address in a RHIP set.

[0016] In 510, the pDNS query information may be utilized to measure statistical features of known malicious domain names and known legitimate domain names. The statistical features are set forth in FIG. 2, and may include, but are not limited to: network-based features, zone-based features, or evidence-based features, or any combination thereof.

[0017] Network-based features. The network-based features may be extracted from the set of RHIPs. The network-based features aim to describe how the operators who own the domain name and the IPs the domain name points to allocate their network resources. Internet bad actors often abuse DNS to operate their malicious networks with a high level of agility. Thus, the domain names and IPs that are used for malicious purposes are often relatively short-lived and may be characterized by a high churn rate. This agility helps bad actors avoid some simple blacklisting techniques and/or being discovered and taken down (e.g., by law enforcement, private organizations, etc.) Quantities that may be measured using the network-based features may include, but are not limited to: the total number of IPs historically associated with the domain name, the diversity of the IPs geographical location, or the number of distinct autonomous systems (ASs) in which they reside, or any combination thereof.

[0018] In order to measure the level of agility of a domain name, numerous features that describe the domain name's network profile may be extracted. The network-based features may include, but are not limited to the following: border gateway protocol (BGP) features; AS features, or registration features, or any combination thereof. BGP features relate to BGP, which is a protocol backing core routing decisions on the Internet. It maintains a table of IP networks or ‘prefixes’ which designate network reachability among ASs. AS features relate to AS, which is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators that presents a common, clearly defined routing policy to the Internet. Registration features relate to registration information of domain names.

[0019] For the discussion below, s will be a domain name (e.g., example.com), and Zone(s) is the set of domain names that include s and all domain names that end with a period followed by s (e.g., domains ending in example.com). Let D={d₁, d₂, . . . , d_m} be a set of domain names. Let A(D) be the set of IP addresses ever pointed by any domain name d in the set D. Given an IP address a, BGP(a) is the set of all IPs within the BGP prefix of a, and AS(a) is the set of IPs located in the AS in which a resides. In addition, these functions may extend to take as input a set of IPs: given IP set A=a_l, a₂, . . . , a_N, BGP(A)=∪_{K=1 . . . N} BGP(a_k); AS(a) may be similarly extended.

[0020] With respect to RHIPs, these can comprise the union of A(d), A(Zone(3LD(d))), and A(Zone(2LD(d))). In order to simplify the notation, A(Zone(3LD(d))) and A(Zone(2LD(d))) will be referred to as A_3LD(d) and A_2LD(d), respectively.

[0021] BGF features may comprise, but are not limited to, the following nine features: the number of distinct BGP profiles related to BGP(A(d)), the number of countries in which these BGP prefixes reside, the number of organizations that own these BGP prefixes; the number of distinct IP addresses in the sets A_3LD(d) and A_2LD(d), the number of distinct BGP prefixes related to BGP(A_3LD(d)) and BGP(A_2LD(d)), or the number of countries in which these two sets of prefixes reside, or any combination thereof.

[0022] The AS features may include, but are not limited to, three features, namely the number of distinct autonomous systems related to AS(A(d)), AS(A_3LD(d)), and AS(A_2LD(d)).

[0023] The registration features may comprise, but are not limited to, six features, namely: the number of distinct registrars associated with the IPs in the A(d) set, the diversity in the registration dates related to the IPs in A(d), the number of distinct registrars associated with the IPs in the A_3LD(d) and A_2LD(d) sets, or the diversity in the registration dates for the IPs in A_2LD(d) and A_2LD(d), or any combination thereof.

[0024] While most legitimate, professionally run Internet services have a stable network profile, which is reflected into low values for the network-based features described above, the profile of malicious networks (e.g., fast-flux networks) may change relatively frequently causing the network-based features described above to be assigned higher values. A domain name from a legitimate zone may exhibit small numbers in its AS features, mainly because the IPs in the RHIP information should belong to the same organization or a very small number of different organizations. On the other hand, if a domain names participates in malicious action (e.g., dotnet activities, flux networks), then it could resign in a large number of different networks. The list of IPs in the RHIP information that corresponds to the malicious domain name may produce AS features with higher values. In the same sense, the homogeneity of the registration information for benign domains may be measured. Legitimate domains may be typically linked to address space owned by organizations that acquire and announce network blocks in some order. Thus, the registration feature values for a legitimate domain name that is owned by the same organizations may produce a list of IPs in the RHIP information that may have small registration feature values. If this set of IPs exhibits high registration features values, it may mean that it very likely resides in different registrars and was registered on different dates. Such registration features may be linked with fraudulent domains.

[0025] Zone-based features. The zone-based features may be extracted from the set of RHDNs. The zone-based features may measure the characteristics of the set RHDNs of domain names historically associated with the domain names. Quantities that may be measured include, but are not limited to: the average length of domain names in RHDNs, or the number of distinct TLDs, the occurrence frequency of different characters, or any combination thereof.

[0026] The intuition behind the zone-based features is that while legitimate Internet services may be associated with many different domain names, these domain names usually have strong similarities. For example, google.com, googlesyndication.com googlewave.com are all related to Internet services provided by Google, and contain the string “google” in their name. On the other hand, malicious domain names related to the same spam campaign, for example, often look randomly generated, and share few common characteristics. Therefore, the zone-based features aim at measuring the level of diversity across the domain names in the RHDNs set.

[0027] The zone-based features may include, but are not limited to: string features and/or TLD features. The string features may include, but are not limited to, the following twelve features: the number of distinct domain names in RHDNs; the average and standard deviation of their length; the mean, median and standard deviation of the occurrence frequency of each single character in the domain names strings in RHDNs; the mean, median and standard deviation of the distribution of 2-grams (e.g., pairs of characters); the mean, median and standard deviation of the distribution of 3-grams.

[0028] The RLD features may include, but are not limited to the following five features: the number of distinct TLD strings that are obtained from the top-level domain; the ratio between the number of domain names whose top level domain is .com; the total number of TLDs different from .com; or the main, median, and standard deviation of the occurrence frequency of the TLD strings; or any combination thereof.

[0029] Note that whenever the mean, median and standard deviation of a certain property is measured, it may be done in order to summarize the shape of its distribution. For example, by measuring the mean, median, and standard deviation of the occurrence frequency of each character in a set of domain name strings, the distribution of the character frequency is shown.

[0030] Evidence-based features. Evidence-based features try to determine to what extent a given domain names is associated with other known malicious domain names or IP addresses. As mentioned above, the knowledge based of known suspicious, malicious, and legitimate domain names and IPs may be collected. The evidence-based features may include the measurement of quantities such as, but not limited to: distinct malware samples that contacted the domain name, or the number of malware samples that connected to any of the IPs pointed by the domain name, or any combination thereof.

[0031] The evidence-based features may include, but are not limited to: honeypot features and/or blacklist features. The honeypot features may include, but are not limited to, the following three features: the number of distinct malware samples that, when executed, try to contact the domain name or any IP address in A(d); the number of malware samples that contact any IP address in BGP(A(d)); or the number of samples that contact any IP address in AS(A(d)); or any combination thereof.

[0032] The blacklist features may include, but are not limited to, the following three features: the number of IP addresses in A(d) that are listed in public IP blacklists; the number of IPs in BGP(A(d)) that are listed in IP blacklists; or the number of IPs in AS(A(d)) that are listed in IP blacklists; or any combination thereof. The blacklist features may be used to identify the re-utilization of known malicious network resources such as IPs, BGPs or even ASs.

[0033] Referring back to FIG. 5, in 515, the information compiled using the statistical features may be utilized by the reputation engine 130 to compute a reputation score for a new domain name, where the reputation score indicates whether the new domain name is likely to be for malicious or legitimate uses. The reputation engine 130 may operate in an off-line training mode and/or an online classification mode. FIG. 3 illustrates the off-line training mode and the on-line training mode. During the off-line training mode, the reputation engine 130 may be trained using the information gathered from a knowledge base, which may be the set of known malicious and legitimate domain names and their related IP addresses. Afterward, during the on-line mode, for each new domain name, the off-line and on-line modes may be utilized to compute the reputation scores.

[0034] Off-Line Training Mode. During off-line training, the reputation engine 130 may build different modules. For example, referring to FIG. 3, in one embodiment, the following modules may be built: the network profile modeling module 310; the network and zone domain name clustering module 315; or the reputation function module 320; or any combination thereof.

[0035] Network Profile Modeling Module. The network profile modeling module 310 may be a model of how well-known networks behave. For example, the network characteristics of popular content delivery networks (e.g., Akamai, Amazon CloudFront, etc.) and/or large popular websites (e.g., google.com, yahoo.com, etc.) may be modeled. FIG. 4(a) illustrates a high level overview of a network profile modeling module 310, according to an embodiment. For any new domain name d, it is fed into a classifier 405 (e.g., 2-class meta) that classifies the domain name d based on models for classes of known domain names. The classification confidence 410 may assign a score indicating the confidence that the new domain name d is in fact part of a known class. For example, multiple sets of domain names that share similar characteristics may be selected, and their network features (as described above) may be learned. The network features may then be used to train a statistical classifier, which will be able to recognize whether a new domain name has network characteristics similar to the popular websites that were utilized. In one embodiment, any or all of the following classes of domain names may be utilized when choosing the multiple sets of domain names from which the network features are utilized. (It should be noted that any other class of domain names may also be utilized.)

• • [0036] Popular Domain Names. This class may comprise a large set of domain names under the following DNS zones: google.com, yahoo.com, amazon.com, ebay.com, msn.com, live.com, myspace.com, and facebook.com.
  • [0037] Common Domain Names. This class may comprise domain names under the top one hundred zones, according to Alexa. This class may exclude all the domain names already included in the Popular Domain Name class.
  • [0038] Akamai Domain Names. Akamai is a very large content delivery network (CDN), and the domain names related to this CDN may have very peculiar network characteristics. In order to model the network profile of Akamai's domain names, a set of domain names may be collected under, for example, any or all of the following zones: akafms.net, akamai.net, akamaiedge.net, akamai.com, akadns.com, and akamai.com.
  • [0039] CDN Domain Names. This class may comprise domain names related to CDNs other than Akamai. For example, domain names may be collected under any or all of the following zones: panthercdn.com, llnwd.net, cloudfront.net, nyud.net, nyucd.net, and redcondor.net. In one embodiment, separating the CDN domain names and the Akamai's domain names may be useful because the Akamai domain names may have a very unique network profile, and learning two separate models for these classes may help achieve better classification accuracy.
  • [0040] Dynamic DNS Domain Names. This class may comprise a large set of domain names registered under either or both of some of the largest dynamic DNS providers: No-IP (www.no-ip.com) and DynDNS (www.dyndns.com).

[0041] For each class of domain names described above, a statistical classifier may be trained in order to distinguish between the classes from each other. Therefore, in one embodiment, five different statistical classifiers may be trained. Thus, given a new domain name, the network profile modeling module may be able to determine whether the new domain name's network profile looks like the profile of: a Popular Domain Name, a Common Domain Name, an Akamai Domain Name, a CDN Domain Name, or a Dynamic DNS Domain Name, or any combination thereof.

[0042] Network and Zone Domain Name Clustering Module. The network and zone domain name clustering module 315 may take the domain names collected in the pDNS database 125 and build clusters of domain names that share similar network-based features and zone-based features (as described above). As shown in FIG. 4(b), network-based clustering is done in 420 using the network-based features, and then zone-based clustering is done in 425 using the zone-based features, then cluster characterization is done is 430.

[0043] The network-based clustering may be done to group together domain names that share the same level of agility. For example, the network-based clustering may group together domain names with similar stable network characteristics, and separate them from domain names related to CDNs or malicious flux network.

[0044] The zone-based clustering 425 may be done after clustering the domain names according to their network-based features in order to split the network-based clusters of domain names into finer groups. In zone-based clustering 425, domain names that are in the same network-based cluster that also share similar zone-based features may be grouped together. Each element of the cluster may be a domain name—IP pair. These two groups of domain names may have belonged to the same network cluster, but were separated into two different clusters by the zone-based clustering phase. For example, consider the domain names d₁=e55.g.akamaiedge.net from the first cluster, and d₂=spzr.in from the second cluster. The reason why d₁ and d₂ were clustered in the same network-based cluster may be because the set of RHIPs (described above) for d₁ and d₂ have similar characteristics. In particular, the network agility properties of d₂ make it look like it was part of a large CDN. However, when the set of RHDNs (described above) for d₁ and d₂ is considered, it is found that the zone-based features of d, are much more stable than the zone-based features of d₂. In other words, while the RHDNs of d₁ share strong domain'name similarities (e.g., they all share the substring “akamai”) and have low variance of the string features (described above), the strong zone agility properties of d₂ may affect the zone-based features measured on d₂'s RHDNs and may make d₂ look very different from d₁.

[0045] For example, referring to FIG. 6, a network and zone based clustering process is illustrated in the case of an Akamai (A) and a malicious (B) domain name. The 1st level clustering may be based on network-based features. The 2nd level clustering may be based on zone based features. As shown in FIG. 6, the Akamai domain name is clustered very differently from the malicious domain name when both the network-based and zone-based features are considered.

[0046] Referring back to FIG. 3, once the network profile modeling module 310 has been used to build a model of well-known network profiles, and the network and zone clustering module 315 has been used to build the domain name clusters, this information may be fed into the reputation function module 320. The reputation function module 320 may aim to assign a reputation score in the interval [0, 1] to domain names, with 0 meaning a low reputation (e.g., likely malicious) and 1 meaning a high reputation (e.g., likely legitimate). The reputation function module 320 may be implemented as a statistical classifier. In order to train the reputation function module 320, each domain name d in the knowledge base of system 100 may be fed into the network profile modeling module 310 and also into the network and zone clustering module 315 to compute two output vectors DC(d) and NM(d). (Details on how these vectors are computed are described below.) In addition, for each domain name d, an evidence features vector EV(d) may be computed (as described above). The reputation function module 320 may then utilize DC(d), NM(d) and EV(d) by creating a feature vector v(d) that combine the NM(d), DC(d) and EV(d) feature vectors. The reputation function module may then be trained using the labeled dataset L={(v(d_i), y_i)}, where i=1 . . . n, and where y_i=0 if d_i is a known malicious domain name; otherwise y_i=1.

[0047] On-Line Mode. Referring back to FIG. 3, after training is complete in the off-line mode, the reputation engine 130 may be used in one-line mode to assign reputation scores to new domain names. For example, given an input domain name d, the reputation engine may compute a score S in the set of [0, 1]. Values of S close to zero may signify that d appears to be related to malicious activities and therefore has a low reputation. On the other hand, values of S close to one may signify that d appear to be associated with benign Internet services, and therefore may have a high reputation. FIG. 7 illustrates a method 700 for computing the reputation score, according to an embodiment. In 705, d may be fed into the network profile modeling module 310, which may comprise the five statistical classifiers described above. The output of the network profile modeling module 310 may be vector NM(d)={c₁, c₂, . . . , c₅}, where c₁ is the output of the first classifier, and may be viewed as the probability that d belongs to the class of Popular Domain Names, c₂ is the probability that d belongs to the class of Common Domain Names, c₃ is the probability that d belongs to the class of Akamai Domain Names, c₄ is the probability that d belongs to the class of CDN Domain Names, and c₅ is the probability that d belongs to the class of Dynamic DNS Domain Names.

[0048] Referring back to FIG. 7, in 710, d may also be fed to the network and zone domain name clustering module 315, which may compute vector DC(d)={l₁, l₂, . . . , l₅}. FIG. 8 illustrates how DC(d) and elements l_i may be computed, according to an embodiment. In 805, the network-based features of d may be extracted, and the closest network-based cluster to d among the network-based clusters computed by the network and zone domain name clustering module 315 may be determined. In 810, the zone-based features of d may be extracted, and the closest zone-based duster to d among the zone-based clusters computed by the network and zone domain name clustering module 315 may be determined. Let C_d be this closest zone-based cluster to d. In 815, a subset V_d⊂C_d of all of the zone-based vectors v_jεC_d may be found when certain conditions exist. In one embodiment, the certain conditions may be the following: (A) dist(z_d, v_j)<R, where z_d is the zone-based vector for d, and R is a predefined radius; and/or (B) V_jεKNN(z_d), where KNN(z_d) is the set of k nearest-neighbors of z_d.

[0049] In 820, a label may be assigned to each vector in the subset of the zone-based vectors. Because the zone-based vectors in V_d may be the training vectors, they may be related to domain names extracted in a knowledge base. Thus, a label may be assigned to each vector v_iεV_d, according to the nature of the domain name d_i from which v_i was computed. In one embodiment, multiple different classes of domain names may be distinguished, including, but not limited to: popular domain names, common domain names, Akamai domain names, CDN domain names, dynamic DNS domain names, span domain names (e.g., DEFINE), flux domain names (e.g., DEFINE), and malware domain names (e.g., DEFINE). Note that many other classes of domain names may be utilized.

[0050] In 825, in order to compute DC(d_i), in one embodiment, the following five statistical features may be computed: the majority class label L (which may be the label that appears the most among the vectors v_iεV_d) (e.g., L may be equal to malware domain name); the standard deviation of label frequencies (e.g., given the occurrence frequency of each label among the vectors v_iεV_d, their standard deviation may be computed); or the mean, median and standard deviation of the distribution of distances between z_d and the vectors v_iεV_d^(L) (e.g., given the subset V_d^(L)⊂V_d of vectors in V_d that are associated with label L); or any combination thereof. Note that many other statistical features may be utilized.

[0051] Referring back to FIG. 7, in 715, once the vectors NM(d) and DC(d) are computed, the evidence vector EV(d) may be computed, as described above. In 720 these three vectors may be concatenated into a sixteen-dimensional feature vector v(d), which may be input to the trained reputation function module 320. The trained reputation function module 320 may then compute a score S=1−f(d), where f(d) may be the probability that d is a malicious domain name. S may then vary, with the lower the value of S, the lower d's reputation, and the higher the value of S, the higher d's reputation.

[0052] While various embodiments have been described above, it should be understood that they have been presented by way of example and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the spirit and scope. In fact, after reading the above description, it will be apparent to one skilled in the relevant art(s) how to implement alternative embodiments. Thus, the present embodiments should not be limited by any of the above-described embodiments.

[0053] In addition, it should be understood that any figures which highlight the functionality and advantages are presented for example purposes only. The disclosed methodology and system are each sufficiently flexible and configurable such that they may be utilized in ways other than those shown. For example, the elements in the flowcharts may be performed in parallel or a different order.

[0054] Further, the purpose of any Abstract of the Disclosure is to enable the U.S. Patent and Trademark Office and the public generally, and especially the scientists, engineers and practitioners in the art who are not familiar with patent or legal terms or phraseology, to determine quickly from a cursory inspection the nature and essence of the technical disclosure of the application. An Abstract of the Disclosure is not intended to be limiting as to the scope of the present invention in any way.

[0055] It should also be noted that the terms “a”, “an”, “the”, “said”, etc. signify “at least one” or “the at least one” in this application (e.g., specification, claims and drawings).

[0056] Finally, it is the applicant's intent that only claims that include the express language “means for” or “step for” be interpreted under 35 U.S.C. 112, paragraph 6. Claims that do not expressly include the phrase “means for” or “step for” are not to be interpreted under 35 U.S.C. 112, paragraph 6.