Skip to content

Add DGA domain object template with algorithm context#512

Open
adulau wants to merge 1 commit intomainfrom
codex/create-dga-domain-object-and-algorithm
Open

Add DGA domain object template with algorithm context#512
adulau wants to merge 1 commit intomainfrom
codex/create-dga-domain-object-and-algorithm

Conversation

@adulau
Copy link
Copy Markdown
Member

@adulau adulau commented Apr 10, 2026

Motivation

  • Provide a dedicated MISP object to model Domain Generation Algorithm (DGA) outputs and capture generation context to improve sharing and detection of DGA-based infrastructure.
  • Close the referenced issue by adding explicit fields for algorithm metadata, seed/epoch/counter, TLD strategy, validity window and malware family, with the USENIX paper as a reference.

Description

  • Add a new object template at objects/dga-domain/definition.json named dga-domain that models generated domains and algorithm context and sets requiredOneOf to domain or algorithm-name.
  • The new object exposes attributes including algorithm-name, algorithm-version, seed, epoch, counter, tld, domain, malware-family, validity-start, validity-end, reference and text for analyst notes.
  • Document the new object by adding its entry to README.md with a link to the object definition and the USENIX reference paper.

Testing

  • Ran ./jq_all_the_things.sh to normalize JSON formatting and reserialize templates (completed, but the environment emitted uuidparse warnings because the uuidparse utility is not installed).
  • Validated JSON syntax with jq using jq . objects/dga-domain/definition.json which succeeded.
  • Checked UUID uniqueness with python3 unique_uuid.py, which produced no conflicts.
  • Schema validation with jsonschema -i objects/dga-domain/definition.json schema_objects.json could not be executed because the jsonschema binary is not available in this environment.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant