I want to know whether a client is infected by detecting malicious activity based on patterns of DNS requests.
e.g.Suppose someone hacked google website and injected codes in it and when user clicks on it then there will be multiple DNS queries.
Suppose one pattern of DNS queries like
request 1: www.google.com
request 2: www.intermediate.com
request 3: www.malicious.com
request 4: www.malaciouscontent.com
Here, first request is valid and legitimate but the requests from 2nd to 4th are causing because of the injected codes and that pattern is what i want to detect if such requests comes in future.


There is no way to reliably detect all malware using DNS analysis only but DNS analysis can help a lot.

While some malware might be detected based on access to known to be bad domains (i.e. domain blacklists) other might be detected because they use uncommon domain names or use a known domain generation algorithm. Deeper analysis can also make domains stand out which have rapidly changing mappings to IP address, i.e. fast flux networks. There is also be malware which stands out because of use of TXT records or similar. But there is also malware which communicates using social media sites and thus does not stand out in most networks. And of course there is malware which uses fixed IP addresses for communication and thus does not cause any DNS traffic at all.

In short: there is no reliable way to detect malware using DNS analysis only. But DNS analysis can help a lot. The easiest ways are probably DNS blacklists provided by various vendors or the use of specific DNS servers like OpenDNS which already block lots of suspicious DNS activity. Apart from that the better you know your network the more unusual activities stand out. These might indicate malware activity, but there might also be other reasons for unusual activity.

| improve this answer | |
  • 1
    Eh...I disagree strongly. DNS logs are a painfully underrated method of detecting malware, especially if you're using RPZ or explicitly whitelisting domains (blacklists are the wrong approach). Most of the malware we see reaches out to bizarre domains and TLDs we have no business dealing with and the rest is denied based on IP blocks. Knowing what domains are being called not only tells us what malicious activity is being attempted but also handily enumerates who our adversaries are before we even begin the reverse engineering process. – Ivan Mar 9 '17 at 15:57
  • 1
    @Johnny: I'm not sure which part of my answer you disagree with. I'm not saying that DNS analysis does not help but actually I have lots of examples of where it can help. I'm trying to say instead that using exclusively DNS analysis is not sufficient to detect all malware. I hope I made this more clear in the edited answer. – Steffen Ullrich Mar 9 '17 at 16:56
  • It is more clear now, yes. Initially I got the impression you were dismissing it as a useful tool despite the examples. – Ivan Mar 9 '17 at 18:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.