US 12,445,410 B2
In-line detection of algorithmically generated domains
Daiping Liu, Sunnyvale, CA (US); Martin Walter, Livermore, CA (US); Ben Hua, San Jose, CA (US); Suquan Li, Saratoga, CA (US); Fan Fei, San Jose, CA (US); Seokkyung Chung, Sunnyvale, CA (US); Jun Wang, Fremont, CA (US); and Wei Xu, Cupertino, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jun. 21, 2023, as Appl. No. 18/212,311.
Application 18/212,311 is a continuation of application No. 16/588,169, filed on Sep. 30, 2019, granted, now 11,729,134.
Prior Publication US 2023/0336524 A1, Oct. 19, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 61/4511 (2022.01); G06F 16/955 (2019.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01); G06N 20/00 (2019.01); H04L 9/40 (2022.01); H04L 61/10 (2022.01); H04L 61/3015 (2022.01); H04L 67/02 (2022.01)
CPC H04L 61/4511 (2022.05) [G06F 16/9566 (2019.01); G06F 21/552 (2013.01); G06F 21/554 (2013.01); G06F 21/56 (2013.01); G06N 20/00 (2019.01); H04L 61/10 (2013.01); H04L 61/3025 (2013.01); H04L 63/0236 (2013.01); H04L 63/029 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01); H04L 63/0209 (2013.01); H04L 63/145 (2013.01); H04L 67/02 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
receive, at a first node, a DNS query in response to a client device making a DNS resolution request;
determine whether the received DNS query implicates an algorithmically generated domain (AGD) based at least in part by performing Markov Chain analysis on a domain included in the received DNS query; and
include, by the first node, in a response to the received DNS query, an indication that the DNS resolution request made by the client device is indicative of the client device engaging in AGD activity;
wherein the indication included in the response to the received DNS query is usable by a security appliance to at least partially remediate the client device; and
a memory coupled to the processor and configured to provide the processor with instructions.