{"id":5255,"date":"2020-06-08T12:16:41","date_gmt":"2020-06-08T19:16:41","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=5255"},"modified":"2022-10-20T13:18:16","modified_gmt":"2022-10-20T20:18:16","slug":"how-cyber-criminals-bypass-defenses-using-dga","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/","title":{"rendered":"How Cyber Criminals Bypass Defenses Using DGA"},"content":{"rendered":"<p>Malicious actors are always finding new ways to bypass any company\u2019s defenses and steal valuable data to make quick money. The more dynamic their approach is the more successful they are in evading security controls that use static methods, like blacklists that are not frequently updated. In this blog, we will explore an advanced technique called Domain Generation Algorithm (DGA) used by cyber criminals to circumvent even the most sophisticated defenses and learn how to defend against such attacks.<\/p>\n<h3><strong>What are DGAs?<\/strong><\/h3>\n<p>Although DGAs stands for\u00a0 Domain Name Algorithms, they should be called AGDs \u2013 algorithmically generated <a href=\"https:\/\/en.wikipedia.org\/wiki\/Domain_name\">domain names<\/a>, because that\u2019s what they are. DGAs are code that programmatically produce a list of domains used by malware clients to communicate with a sequence of command and control (C&amp;C) sites. These domains are used as rendezvous points for malware and hacker controlled servers to communicate stealthily on a backhaul network. Once one of the dynamically generated domains is detected and blocked by IT security, the malware client and C&amp;C server switches to the next one on the list to bypass defenses.<\/p>\n<p>DGA domains have the following characteristics:<\/p>\n<ul>\n<li>They have lengthy nonsensical names &#8211; com, since they have a lesser chance of clashing with a pre-registered domain.<\/li>\n<li>They are usually encoded or encrypted using the same crypto algorithms that both malware client and C&amp;C server share, making them hard to decode\/decipher.<\/li>\n<li>Thousands of DGA domains are generated per day, but only a few are active or resolvable, which is known only to the malware client and C&amp;C server.<\/li>\n<li>Even when they are active, they have a short life span (often only a few days), making it hard to blacklist.<\/li>\n<\/ul>\n<h3><strong>\u00a0<\/strong><strong>Why are DGAs difficult to detect?<\/strong><\/h3>\n<p>Domain Generation Algorithms create a constantly moving target for any perimeter firewall to detect and block using domain-based blacklists. Most algorithms use different approaches to randomize the letters in the second level domain that precedes \u201c.com\u201d. These domains are constantly changing based on a static and dynamic seed, which makes it very difficult to detect.<\/p>\n<p>The DGA technique was first popularized by the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Conficker\">Conficker worm<\/a> back in 2008, which at first generated 250 domains per day. With a new strain of Conficker (.C), the malware would generate 50,000 domains a day, which became a huge effort for law enforcement to track every day.<\/p>\n<p>Even the IP address that these DGA domains resolve to can be changing to bypass firewalls that use IP-based blacklists. by using a technology called <a href=\"https:\/\/www.welivesecurity.com\/2017\/01\/12\/fast-flux-networks-work\/\">Fast-Flux<\/a>. To complicate matters further, most systems that make up the C&amp;C network are not actually responsible for hosting malicious content. This task is reserved for a few machines that act as servers of malicious content; the rest act as redirectors that help mask the real IP addresses of the systems controlled by cyber criminals.<\/p>\n<h3><strong>What Are the Ways to Detect DGA?<\/strong><\/h3>\n<p>There are two major methods of detecting DGA-based cyber-attacks.<\/p>\n<ol>\n<li><strong>Reverse-engineering method:<\/strong> You can calculate the next list of DGA domains, if you have access to the source code of the malware (and maybe the servers). Or if you have already observed a few DGAs in sequence and you can guess or estimate the algorithm, you can do the same. However, this method has critical weaknesses:\n<ul>\n<li>You need a copy of malware source-code, which may be hard to obtain<\/li>\n<li>Your guess could be wrong, because your sample set is limited.<\/li>\n<li>You have to assume the hacker is using the source-code, which may not be true.<\/li>\n<li>The amount of domain names predicted by this method may be too large, which exceeds the amount of memory allowed for blacklists in traditional firewalls<\/li>\n<\/ul>\n<\/li>\n<li><strong>Machine Learning (ML) method: <\/strong>You can build data models using an existing sample of domain names generated by DGAs and predict unknown DGAs that will be used by cyber criminals. This approach does not suffer the drawbacks listed above with the reverse-engineering technique.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h3><strong>How Can You Defend Against DGAs?<\/strong><\/h3>\n<p>Statistical models using machine learning is the better way to detect DGA based domain names. The following factors should be taken into consideration while building these ML models.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-5256 size-medium\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/DGA-blog-300x291.png\" alt=\"\" width=\"300\" height=\"291\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/DGA-blog-300x291.png 300w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/DGA-blog-1024x993.png 1024w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/DGA-blog-768x745.png 768w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/DGA-blog.png 1141w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<ul>\n<li><strong>Entropy: <\/strong>How much randomness is there in the domain name?<\/li>\n<li><strong>Lexical: <\/strong>Does it appear to be encoded or encrypted?<\/li>\n<li><strong>N-gram: <\/strong>Does the domain name contain words in a language?<\/li>\n<li><strong>Frequency: <\/strong>Are far too many requests sent to the same external domain?<\/li>\n<li><strong>Size: <\/strong>Is the domain name unusually long?<strong>\u00a0<\/strong><\/li>\n<\/ul>\n<p>Each of the above statistical characteristics are assigned points, and these individual points are aggregated to compute a consolidated score. When the consolidated score exceeds a certain threshold (which can be tuned), the security analyst can determine whether a domain name used by malware is generated by DGA or not.<\/p>\n<h3><strong>Infoblox to the Rescue<\/strong><\/h3>\n<p>Infoblox can shut down DNS-based data exfiltration, DGA and other aggressive malware through automation, curated threat intelligence in BloxOne\u2122 Threat Defense and advanced analytics that combine signature-based detection and machine learning. The solution leverages greater processing capabilities of the cloud to detect a wider range of threats, including data exfiltration, DGA, fast flux, file-less malware and dictionary DGA. It relies on a hybrid security model that protects users and data wherever they happen to be across any infrastructure.<\/p>\n<p>Learn More about DGA in this Infoblox white paper :\u00a0 <a href=\"https:\/\/info.infoblox.com\/resources-whitepapers-artificial-intelligence-to-detect-domain-generation-algorithms\">Using AI\/ML to Detect Domain Generation Algorithms<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Malicious actors are always finding new ways to bypass any company\u2019s defenses and steal valuable data to make quick money. The more dynamic their approach is the more successful they are in evading security controls that use static methods, like blacklists that are not frequently updated. In this blog, we will explore an advanced technique [&hellip;]<\/p>\n","protected":false},"author":333,"featured_media":2882,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[2],"tags":[189,75,40,286,30],"class_list":{"0":"post-5255","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-cybersecurity","9":"tag-security-infrastructure","10":"tag-threat-intelligence","11":"tag-dga","12":"tag-dns","13":"entry"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>How Cyber Criminals Bypass Defenses Using DGA<\/title>\n<meta name=\"description\" content=\"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Cyber Criminals Bypass Defenses Using DGA\" \/>\n<meta property=\"og:description\" content=\"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-08T19:16:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-20T20:18:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"454\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Narayan Makaram\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Narayan Makaram\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/\"},\"author\":{\"name\":\"Narayan Makaram\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/e590a2634abc746b9ccc3c0439784d14\"},\"headline\":\"How Cyber Criminals Bypass Defenses Using DGA\",\"datePublished\":\"2020-06-08T19:16:41+00:00\",\"dateModified\":\"2022-10-20T20:18:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/\"},\"wordCount\":894,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg\",\"keywords\":[\"Cybersecurity\",\"Security Infrastructure\",\"Threat Intelligence\",\"DGA\",\"DNS\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/\",\"name\":\"How Cyber Criminals Bypass Defenses Using DGA\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg\",\"datePublished\":\"2020-06-08T19:16:41+00:00\",\"dateModified\":\"2022-10-20T20:18:16+00:00\",\"description\":\"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg\",\"width\":660,\"height\":454,\"caption\":\"Streamlining The Newell Rubbermaid Global Grid\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/how-cyber-criminals-bypass-defenses-using-dga\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How Cyber Criminals Bypass Defenses Using DGA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/e590a2634abc746b9ccc3c0439784d14\",\"name\":\"Narayan Makaram\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_333_1586469017-96x96.jpg\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_333_1586469017-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_333_1586469017-96x96.jpg\",\"caption\":\"Narayan Makaram\"},\"description\":\"Narayan Makaram, CEO, Cybernetix Security, has over 20 years of experience, leading product marketing, product management and strategic alliances at several companies including Arctic Wolf Networks, Imperva, Tenable, FireEye, ArcSight and Hewlett-Packard. His expertise are in the areas of Managed Detection and Response (MDR), Network Security, Application Security, Security Information and Event Management(SIEM) and Data Protection.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/narayan-makaram\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How Cyber Criminals Bypass Defenses Using DGA","description":"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/","og_locale":"en_US","og_type":"article","og_title":"How Cyber Criminals Bypass Defenses Using DGA","og_description":"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.","og_url":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/","og_site_name":"Infoblox Blog","article_published_time":"2020-06-08T19:16:41+00:00","article_modified_time":"2022-10-20T20:18:16+00:00","og_image":[{"width":660,"height":454,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg","type":"image\/jpeg"}],"author":"Narayan Makaram","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Narayan Makaram","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/"},"author":{"name":"Narayan Makaram","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/e590a2634abc746b9ccc3c0439784d14"},"headline":"How Cyber Criminals Bypass Defenses Using DGA","datePublished":"2020-06-08T19:16:41+00:00","dateModified":"2022-10-20T20:18:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/"},"wordCount":894,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg","keywords":["Cybersecurity","Security Infrastructure","Threat Intelligence","DGA","DNS"],"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/","url":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/","name":"How Cyber Criminals Bypass Defenses Using DGA","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg","datePublished":"2020-06-08T19:16:41+00:00","dateModified":"2022-10-20T20:18:16+00:00","description":"While your network may be secure, there are always threats of Domain Generation Algorithms. Learn more about protecting yourself from cyber criminals here.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/Streamlining-The-Newell-Rubbermaid-Global-Grid.jpg","width":660,"height":454,"caption":"Streamlining The Newell Rubbermaid Global Grid"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/security\/how-cyber-criminals-bypass-defenses-using-dga\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.infoblox.com\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"How Cyber Criminals Bypass Defenses Using DGA"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/e590a2634abc746b9ccc3c0439784d14","name":"Narayan Makaram","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_333_1586469017-96x96.jpg","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_333_1586469017-96x96.jpg","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_333_1586469017-96x96.jpg","caption":"Narayan Makaram"},"description":"Narayan Makaram, CEO, Cybernetix Security, has over 20 years of experience, leading product marketing, product management and strategic alliances at several companies including Arctic Wolf Networks, Imperva, Tenable, FireEye, ArcSight and Hewlett-Packard. His expertise are in the areas of Managed Detection and Response (MDR), Network Security, Application Security, Security Information and Event Management(SIEM) and Data Protection.","url":"https:\/\/www.infoblox.com\/blog\/author\/narayan-makaram\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/5255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/333"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=5255"}],"version-history":[{"count":2,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/5255\/revisions"}],"predecessor-version":[{"id":8161,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/5255\/revisions\/8161"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/2882"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=5255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=5255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=5255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}