I had the idea of applying Scrabble scores to DGA domains over the summer of 2018, but the idea was rekindled when I saw Marcus Ranum‘s keynote at BroCon 2018. He talked about the advantages of scoring systems: they are fast, they are simple, and they can be surprisingly effective.
Domain Generating Algorithms (DGAs)
Malware uses DGAs to generate hundreds or thousands of new domain names daily. The malware then attempts to contact some or all of the domains. If a successful attempt is made to a control server, the malware will receive new instructions for malicious activity. The people and systems managing the malware need only register one new domain a day, but a defender would have to anticipate and/or discover thousands a day. To read more about DGAs, I recommend these articles from Akamai:
- What Are Domain Generation Algorithms (DGAs) and Why Should You Care?
- A Death Match of Domain Generation Algorithms
- Spotlight on Malware DGA Communication Technique
Scrabble Scores and DGAs
I’ve noticed that some, not all Domain Generating Algorithms produce unreadable domains like:
rjklaflzzdglveziblyvvcyk.com
Continue reading Identifying DGA domains using Scrabble scores: a naive approach