Multi-tiered server architecture to mitigate malicious traffic

A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising:

• obtaining a first plurality of domain name system traffic records of a domain name system platform, the first plurality of domain name system traffic records associated with a source device that is submitting domain name system queries, the source device having a first status, wherein a first-tier domain name system authoritative server of the domain name system platform is configured to forward the domain name system queries from the source device to at least a first second-tier domain name system authoritative server of the domain name system platform designated for the first status;
• detecting anomalous domain name system traffic records from the first plurality of domain name system traffic records;
• identifying a change of the source device from the first status to a second status, based upon the detecting the anomalous domain name system traffic records;
• and
• reconfiguring the first-tier domain name system authoritative server to redirect the domain name system queries from the source device to at least a second second-tier domain name system authoritative server designated for the second status, in response to identifying the change of the source device from the first status to the second status.

A device comprising:

• a processing system including at least one processor;
• and
• a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
• obtaining a first plurality of domain name system traffic records of a domain name system platform, the first plurality of domain name system traffic records associated with a source device that is submitting domain name system queries, the source device having a first status, wherein a first-tier domain name system authoritative server of the domain name system platform is configured to forward the domain name system queries from the source device to at least a first second-tier domain name system authoritative server of the domain name system platform designated for the first status;
• detecting anomalous domain name system traffic records from the first plurality of domain name system traffic records;
• identifying a change of the source device from the first status to a second status, based upon the detecting the anomalous domain name system traffic records;
• and
• reconfiguring the first-tier domain name system authoritative server to redirect the domain name system queries from the source device to at least a second second-tier domain name system authoritative server designated for the second status, in response to identifying the change of the source device from the first status to the second status.