In the context of digital information, entropy-specifically information entropy-is typically thought of as a measure of randomness or uncertainty in data. While this term is probably not new to you, the meaning of entropy depends on the context in which it is used. Furthermore, you are probably familiar with Shannon entropy and how it is used to measure randomness. If you have worked in InfoSec for long, you have no doubt heard the term entropy. Ready? Let the math begin… What Is Entropy? Because some families of malware use domain generation algorithms that change domains frequently, blacklisting these types of domains is not an efficient means to protect environments.

I will then show how relative entropy can be utilized against letter frequency patterns in domain names to identify malicious ones. I’ll first explain what is typically meant when people talk about entropy (Shannon entropy) before moving on to a similar formula (relative entropy) which has better applications in information security. In this article, we’ll dig into the possibility of using entropy in threat hunting to help identify adversarial behavior. This is the category entropy falls into: looking at a known technique (randomized data to thwart atomic indicators) to find both known and unknown malware. Behavioral indicators are the next level, which use knowledge of adversarial techniques to find both known and unknown activity. “Antivirus is dead” is a common refrain in the information security space, but if you look below the surface, what it really means is “atomic indicators are dead.” While there is value in static indicators, they are the bare minimum standard for detection these days and suffer from numerous drawbacks.

Entropy formula