TECHNICAL FIELD

This application relates generally to enterprise networking and domain name management.

BACKGROUND

Undesirable software, such as computer viruses and spyware, generally known as “malware,” affect many computers and enterprise networks. Malware applications are often associated with potentially malicious domain names hosted on servers belonging to bad actors. The malware will often contact, or “call home,” to these servers, which then introduce viruses, steal account information, or perform other malicious actions. Some malware designers use randomly generated domain names to identify the host servers that manage, instruct, or control the malware. These domain names, based on the fact that they are randomly generated, may have parts that are not be based on any dictionary word. For example, domain name “dbcibwqijdb.org” may represent a potential malware domain name, since the domain name has such an anomalous sequence of alphanumeric characters, and is an unlikely destination for an innocent web surfer. Many malware distribution sites may use such fabricated domain names to spread, manage, and control malware applications to unsuspecting users.

Conventional computer security techniques for detecting potential malware domain names may have limited effectiveness, can be time-consuming, and are often resource-intensive. For example, conventional computer security techniques would take each domain name, one at a time, and loop through every dictionary word looking for matches between dictionary words and the words parsed from the domain name. The problem with this approach is that the dictionary words are on average 5.1 letters long, but domain names are typically 10 characters long (based on top 1 million websites) (http://www.gaebler.com/Domain-Length-Research.htm). As result, there are 3.06×1013operations needed to perform that matching query, which, on a quad-core 2.8 GHz server, takes between 24 to 36 hours to complete. Thus, such conventional techniques for detecting potential malware domain names are very time-consuming.

As an improvement upon this technique, if a security company is able to determine how a particular piece of malware is generated, the security company could potentially take remedial actions with respect to those domains by using domain generation algorithms where the security vendors would have to reverse engineer the malware program, for example, executable code to derive the exact algorithm being used for generating domain names such that they can be blocked. Typically, malware designers complicate their domain generation algorithms, and do so at a level of sophistication that makes reverse engineering the malware and domain generation algorithms in a timely manner difficult. For instance, a researcher may need to expend months of effort to reverse engineer a single domain generation algorithm. In contrast, malware designers can modify the workings of their domain generation algorithms with relative ease/speed, and therefore by the time the researcher has discovered how the domain generation algorithms works, the malware designer can easily have switched to a new algorithm, and again taking potentially months to discover how the new algorithm works. Consequently, the reverse engineering of malware programs is resource-intensive and time-intensive such that precious time may be lost before the domain generation algorithm can be cracked to detect such domain name queries.

The reverse engineering effort applied to the domain generation algorithm is also not scalable for similar future attacks because the samples of existing computer viruses or other malware are required in order to detect future infections. Therefore, for new malware, i.e., malware that affects computers for the first time and has not been seen or analyzed before, it can be more difficult to prevent and detect such malware. In addition, in a domain name service (DNS) process where one domain name is mapped to a changing set of IP-addresses, such combination would be even more difficult to detect.

SUMMARY

What is therefore needed is a technique for monitoring and recognizing problematic domain names by determining whether domain names within uniform resource links (URLs) are associated with incidents of malicious behavior without the need to download and reverse engineer malicious code. A system server may execute a scanning software, such an executable software program that may instruct the system server to search all or a subset of domain names in an enterprise network. The scanning software may then identify the domain names containing particular malware attributes, according to a malicious-code dataset. The system server executing the scanning software may scan through the identified domain names to identify particular strings, values, or code-portions, and take a remedial action according to the scanning software programming.

In one embodiment, a server-implemented method comprising receiving, by a server, a request from a computing device of a user to access a first website associated with a first domain name; upon determining, by the server, that the first domain name is in a blacklist record of a case management database comprising a set of one or more blocked domain names, preventing, by the server, access to the first domain name; receiving, by the server, a plurality of log files from a plurality of data sources configured to generate and store the plurality of the log files, wherein each of the plurality of log files contains a domain name field associated with one of a plurality of domain names, the plurality of domain names comprising the first domain name; parsing, by the server, the domain name field from each respective log file; identifying, by the server, one or more unique domain names in a plurality of domain name fields parsed from the plurality of log files; querying, by the server, a whitelist record and the blacklist record stored in the case management database to determine if there is a record of any of the one or more unique domain names, the whitelist record comprising a set of one or more acceptable domain names; upon determining that the first domain name in the one or more unique domain names is in the blacklist record, automatically foregoing, by the server, further processing associated with the first domain name; executing, by the server, a protocol to determine a credibility score for each of remaining one or more unique domain names based at least upon a length of the each of the remaining one or more unique domain names and a comparison of each of the remaining one or more unique domain names with a domain name corpus stored in a dictionary database, the domain name corpus comprising a plurality of words; upon determining that the credibility score for a second domain name in the one or more remaining unique domain names fails an acceptability threshold, updating, by the server, the blacklist record to include the second domain name; receiving, by the server, a new request from the computing device of the user to access a second website associated with the second domain name; and upon determining that the second domain name is in an updated blacklist record, preventing, by the server, access to the second domain name.

In another embodiment, a system may include a computing device of a user; a dictionary database comprising a domain name corpus, the domain name corpus comprising a plurality of words; a case management database storing a blacklist record comprising a set of one or more blocked domain names and a whitelist record comprising a set of one or more acceptable domain names; and a server. The server is configured to receive a request from the computing device of the user to access a first website associated with a first domain name; upon determining that the first domain name is in the blacklist record, prevent access to the first domain name; receive a plurality of log files from a plurality of data sources configured to generate and store the plurality of the log files, wherein each of the plurality of log files contains a domain name field associated with one of a plurality of domain names, the plurality of domain names comprising the first domain name; parse the domain name field from each respective log file; identify one or more unique domain names in a plurality of domain name fields parsed from the plurality of log files; query the whitelist record and the blacklist record to determine if there is a record of any of the one or more unique domain names; upon determining that the first domain name in the one or more unique domain names is in the blacklist record, automatically forego further processing associated with the first domain name; execute a protocol to determine a credibility score for each of remaining one or more unique domain names based at least upon a length of the each of the remaining one or more unique domain names and a comparison of each of the remaining one or more unique domain names with the domain name corpus; upon determining that the credibility score for a second domain name in the one or more remaining unique domain names fails an acceptability threshold, update the blacklist record to include the second domain name; receive a new request from the computing device of the user to access a second website associated with the second domain name; and upon determining that the second domain name is in an updated blacklist record, prevent access to the second domain name.

In another embodiment, a computer-implemented method includes receiving, by a computer, a plurality of log files from a plurality of data sources configured to generate and store the plurality of the log files, wherein each respective log file contains a domain name field. The computer-implemented method further includes parsing, by the computer, the domain name field from each respective log file. The computer-implemented method further includes identifying, by the computer, one or more unique domain names in the domain name fields parsed from the plurality of log files. The computer-implemented method further includes determining, by the computer, a credibility score for each respective unique domain name based upon a comparison with a domain name corpus stored in a dictionary database, the domain name corpus comprising a plurality of words. The computer-implemented method further includes upon determining that the credibility score for a unique domain name in the one or more unique domain names fails an acceptability threshold, updating, by the computer, a case management database configured to store a plurality of security records, and transmitting, by the computer, an alert to one or more administrator devices, the alert identifying the unique domain name.

In another embodiment, a system includes a plurality of data sources, a case management database, and a computer. The computer is configured to receive a plurality of log files from the plurality of data sources configured to generate and store the plurality of the log files, wherein each respective log file contains a domain name field. The computer is further configured to parse the domain name field from each respective log file. The computer is further configured to identify one or more unique domain names in the domain name fields parsed from the plurality of log files. The computer is further configured to determine a credibility score for each respective unique domain name based upon a comparison with a domain name corpus stored in a dictionary database, the domain name corpus comprising a plurality of words. The computer is further configured to, upon determining that the credibility score for a unique domain name in the one or more unique domain names fails an acceptability threshold: update the case management database configured to store a plurality of security records and transmit an alert to one or more administrator devices, the alert identifying the unique domain name.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the subject matter as claimed.

