Monitoring and analysis of interactions between network endpoints

A method for monitoring and analysis of interactions between network endpoints, comprising:

• collecting Domain Name System (DNS) response data from a network device, comprising:
• identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53;
• determining network endpoint interactions based on an analysis of the DNS response data;
• generating a graph corresponding to the network endpoint interactions;
• grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
• determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
• comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time;
• and
• in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred;
• and
• in response to a determination that the anomalous network activity has occurred, performing a remedial action.

A computer program product for monitoring and analysis of interactions between network endpoints, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• collecting Domain Name System (DNS) response data from a network device, comprising:
• identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53;
• determining network endpoint interactions based on an analysis of the DNS response data;
• generating a graph corresponding to the network endpoint interactions;
• grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
• determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
• comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time;
• and
• in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred;
• and
• in response to a determination that the anomalous network activity has occurred, performing a remedial action.

A system for monitoring and analysis of interactions between network endpoints, comprising:

• a controller for collecting network data from a plurality of network devices in an enterprise network, wherein the collecting of the network data comprises identifying DNS responses from the plurality of network devices that match User Datagram Protocol (UDP) port 53;
• a data store in communication with the controller for storing the network data;
• an analyzer in communication with the data store for performing an analysis of the network data to determine interactions between network endpoints;
• a graphics visualizer in communication with the analyzer for generating a graph based on the interactions between network endpoints, and grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions;
• and
• a determiner in communication with the graphics visualize for determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising:
• comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time;
• and
• in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred;
• and
• in response to a determination that the anomalous network activity has occurred, performing a remedial action.