Names That Were Generated, Not Typed DGA

The log

A Zeek dns.log, a SIEM export, a resolver’s own log, or anything with a name, a machine and a response code in it. The columns are worked out from the header where there is one and from the shape of the values where there is not, and can be set by hand below if it guesses wrong. It is read by this page on this device. A DNS log is a list of everything everyone in the building looked at, which is precisely why this sort of analysis normally needs a purchase order and a data processing agreement.

Which column is which

Only the name is essential. Without the machine, everything is treated as one machine and the bursts run together. Without the time, the window stops working and a day’s failures are judged as one. Without the response code, nothing can be told to have failed, which is most of the signal.

What it found

Every name that did not exist, by machine along the side and by time across. A generator shows up as a dense vertical band: hundreds of names in minutes. A decommissioned printer is an even scatter all day. The difference is visible before any arithmetic, and that is most of the method.

Every group, and which tests it passed

Four tests, all four required, and each useless alone. Many: enough distinct names that do not exist, inside one window. Once each: asked about once or twice rather than over and over, which is what separates a generated list from a dead printer. Registered level: varying the part of the name that decides which server answers, rather than a label underneath a parent. Not sheltered: that parent does not answer for anything else in this log, which is what a content network’s random names always do.

What scoring the names would have cost

One in 550 at ninety per cent detection is the published figure for a character-pair scorer; without an allow-list in front of it the rate on ordinary domains is around eight per cent. Neither of those is a bad implementation. They are what happens when a test with a small error rate meets a haystack, and it is the same arithmetic that makes a screening test for a rare disease produce mostly false alarms. Put your own numbers in and see what the queue looks like.

Settings

Raise the window and a slow generator that works through its list over an hour still lands in one group, at the cost of pulling more ordinary failures in with it. Lower the distinct-name count to catch a short list, at the cost of raising every machine with a handful of typos. The numbers are yours because the right ones depend on your network, and a tool that hid them behind a single sensitivity dial would be pretending otherwise.

The working