DNS tunneling prevention

#The present invention relates in general to computing systems, and more particularly to, various embodiments for domain name service (DNS) tunneling prevention using a computing processor.

#In today's society, consumers, business persons, educators, and others use various computing network systems with increasing frequency in a variety of settings. A popular forum for worldwide data communication linking together computers on a global basis is the Internet. Generally, an Internet Web page's address or URL is made up of the name of the server along with the path to the file or the server. Rather than using a Web hosting service's server name as their URL, most companies and many individuals and other entities prefer a “domain name” of their own choosing. A domain name is a meaningful and easy-to-remember “handle” for an Internet address. The domain name system (DNS) is a name resolution protocol through which Internet domain names are located and translated into Internet Protocol addresses. DNS converts host names to IP addresses and vice-versa. Each domain is managed by a DNS name server, which is a server that contains the host name information about the hosts and subdomains within its domain.

#However, in recent years, hackers have increasingly utilized the DNS network protocol as a medium for a covert channel. Communications that would otherwise be disallowed by network firewalls or other security monitoring systems may be able to readily pass through a network undetected as a DNS communication thereby compromising integrity and security.

#In order that the advantages of the invention will be readily understood, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

#FIG. 1 is a block diagram depicting an exemplary cloud computing node according to an embodiment of the present invention;

#FIG. 2 is an additional block diagram depicting an exemplary cloud computing environment according to an embodiment of the present invention;

#As previously indicated, the Domain Name System (DNS) network protocol is being increasingly utilized by malicious actors as a medium for a covert channel. Communications that would otherwise be disallowed by network firewalls or other security monitoring systems may be able to readily pass through a network undetected as a DNS communication thereby compromising integrity and security. Further, the DNS protocol has significant room for user-defined data and supplementary text fields which may be utilized by a hacker to transmit covert information. Additionally, DNS servers are decentralized, making it easy to set up a DNS server that will function as the receiving end of covert DNS tunnels.

#For example, a botnet may be a collection of compromised hosts, called bots. These bots are controlled by a bot master through a command and control (C&C) channel. Botnets can be classified as according to the underlying C&C communication protocol. The term botnet is also used to refer to a collection of compromised computers/devices (e.g., often referred to as zombie computers/devices, such as computers executing software). Botnets are usually installed via drive-by downloads exploiting web browser vulnerabilities, worms, Trojan horses, and/or backdoors, under a common C&C infrastructure. Malicious actors are currently subverting the DNS protocol to exchange information between a C&C bot master and its controlled hosts. Specially crafted DNS Queries are able to convey information to C&C collectors causing undetected exfiltration of information from corporate networks. In a similar fashion, specially crafted DNS resource records (RR's) are employed to distribute instructions and data to controlled machines.

#Furthermore, these malicious actors execute DNS tunneling and exfiltration techniques by crafting unique subdomains and RR responses. Thus, a motivating factor for DNS tunneling by the malicious actor is to cause exfiltration of data from controlled networks. Accordingly, the present technology provides a cognitive method that can collect, analyze, classify and report where anomalous DNS traffic is being carried out using DNS tunneling detection operations to prevent the DNS tunneling activity and/or thwart the exfiltration of data via DNS tunneling methods.