Technique used by malware to automatically and dynamically generate a large number of domain names that will serve as command-and-control channels, making infrastructure blocking practically impossible.
A domain generation algorithm is a deterministic, often secret function embedded in malware that produces each day a list of hundreds or thousands of domain names from a seed, typically the current date. The attacker need only register whichever domain they choose to activate from among the thousands generated, while the malware attempts to connect to each in turn until it finds one that responds. The technique was popularized by the Conficker botnet in 2008, which generated up to 50,000 domains per day, paralyzing advance blocking attempts by authorities. Since then, DGA variants have been identified in dozens of major malware families. For defenders, the natural countermeasure is prediction: if the algorithm is known or deduced through reverse engineering, it is possible to calculate in advance the complete list of future domains and proactively block them, which security researchers did during the fight against Conficker. DNS traffic analysis is now a standard detection vector in SIEMs: queries towards domains with high randomness and low historical prevalence constitute a strong signal of DGA activity. For threat intelligence, recognizing a DGA family enables attribution of an incident to a known group and prediction of its other potential targets.
During analysis of an infected banking network, analysts identify in DNS logs a series of queries towards 24-character random domains with TLD .top, receiving no response. The pattern is recognized as the DGA signature of the Dridex family. Extracting the seed from the sample enables calculation of the month's entire domain set and proactive alerting of the bank's other clients.
DGA, domain generation algorithm, génération automatique de domaines, algorithme de génération de domaines