Domain generation algorithm (DGA)
A domain generation algorithm (DGA) lets malware compute a new list of rendezvous domains every day, so defenders cannot block a fixed address.
How it works
Malware and its operator share an algorithm and a seed (often the date). The operator registers a few of the generated names; infected machines try them all until one answers.
The resulting names usually look random, which is also how many are detected.
How to protect yourself
- Flag DNS queries for long random-looking names, especially many failed ones from one host.
- Blocklists built from reversed DGAs can pre-empt future names.