Back to results
US 10,764,307 B2Granted
Extracted data classification to determine if a DNS packet is malicious
AssigneeHewlett Packard Enterprise Development LP
InventorPratyusa K. Manadhata
Life of this patent
Estimating the term…
Abstract
Examples herein disclose an extraction of data from a payload field within a domain name system (DNS) packet. The extracted data is classified according to a level of risk associated with the extracted data. Based on the classification, the DNS packet may be determined as malicious.
Claims16
A method executed by a computing device, the method comprising:
- extracting data from a payload field within a domain name system (DNS) packet, wherein the extracted data comprises a qname from a question field within the DNS packet;
- classifying the extracted data according to a level of risk associated with the extracted data, wherein classifying the extracted data according to the level of risk associated with the extracted data comprises:
- processing the extracted data against a list of malicious domains;
- classifying the extracted data as a high level risk responsive to a determination that the extracted data corresponds to the list of malicious domains;
- processing the extracted data against a list of benign domains responsive to a determination that the extracted data does not correspond to the list of malicious domains;
- classifying the extracted data as a low level risk responsive to a determination that the extracted data corresponds to the list of benign domains;
- and
- in response to the determination that the extracted data does not correspond to the list of malicious domains, and a determination that the extracted data does not correspond to the list of benign domains, classifying the extracted data at a further level of risk between the high level risk and the low level risk;
- and
- determining whether the DNS packet is malicious based on the classification.
7 more elements
A system comprising:
- a processor;
- and
- a non-transitory storage medium storing instructions executable on the processor to:
- receive a domain name system (DNS) packet sent to or transmitted from a DNS server;
- extract data from a payload field within the DNS packet, wherein the extracted data comprises a qname from a question field within the DNS packet;
- classify the extracted data according to a level of risk associated with the extracted data, wherein the classifying of the extracted data comprises:
- processing the extracted data against a list of malicious domains;
- classifying the extracted data as a high level risk responsive to a determination that the extracted data corresponds to the list of malicious domains;
- processing the extracted data against a list of benign domains after a determination that the extracted data does not correspond to the list of malicious domains;
- classifying the extracted data as a low level risk responsive to a determination that the extracted data corresponds to the list of benign domains;
- and
- in response to the determination that the extracted data does not correspond to the list of malicious domains, and a determination that the extracted data does not correspond to the list of benign domains, classifying the extracted data at a further level of risk between the high level risk and the low level risk;
- and
- determine whether the DNS packet is malicious based on the classifying of the extracted data according to the level of risk associated with the extracted data.
11 more elements
A non-transitory machine-readable storage medium comprising instructions that when executed cause a computing device to:
- extract data from a payload field within a domain name system (DNS) packet, wherein the extracted data comprises a qname from a question field within the DNS packet;
- classify the extracted data according to a level of risk associated with the extracted data, wherein the classifying of the extracted data comprises:
- processing the extracted data against a list of malicious domains;
- classifying the extracted data as a high level risk responsive to a determination that the extracted data corresponds to the list of malicious domains;
- processing the extracted data against a list of benign domains responsive to a determination that the extracted data does not correspond to the list of malicious domains;
- classifying the extracted data as a low level risk responsive to a determination that the extracted data corresponds to the list of benign domains;
- and
- in response to the determination that the extracted data does not correspond to the list of malicious domains, and a determination that the extracted data does not correspond to the list of benign domains, classifying the extracted data at a further level of risk between the high level risk and the low level risk;
- and
- identify whether the DNS packet is malicious based on the level of risk;
- log the DNS packet based on an identification of the DNS packet as malicious.
8 more elements
Dependencies are inferred from the claim text.