Detection of DNS (domain name system) tunneling and exfiltration through DNS query analysis
AssigneeCisco Technology, Inc.
InventorBrad J. Antoniewicz
Life of this patent
Estimating the term…
Abstract
In one embodiment, a method includes collecting DNS (Domain Name System) communications, analyzing the DNS communications, and identifying DNS tunneling or exfiltration based analysis of the DNS communications. Analyzing the DNS communications includes identifying a distinct query count for each of a plurality of clients over a specified time period and a data transfer direction between the clients and one or more servers, and categorizing the DNS communications based on session features associated with at least one of query type, transfer capability, and server response. An apparatus and logic are also disclosed herein.
Claims16
A method comprising:
- collecting and storing DNS (Domain Name System) communications comprising query and response information;
- analyzing said stored DNS communications;
- and
- identifying DNS tunneling or exfiltration based on analysis of said DNS communications;
- wherein analyzing said DNS communications comprises:
- identifying a distinct query count associated with a registered level-domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers;
- and
- categorizing said DNS communications based on session features associated with query type, wherein said categorization is based on transfer capability, server response, and query type diversity.
An apparatus comprising:
- a DNS (Domain Name System) communications collector for collecting query and response information;
- memory for storing said DNS communications;
- and
- a DNS communications analyzer for identifying DNS tunneling or exfiltration based on analysis of said stored DNS communications;
- wherein the DNS communications analyzer is configured for identifying a distinct query count associated with a registered level-domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers, and categorizing said DNS communications based on session features associated with query type, wherein said categorization is based on transfer capability, server response, and query type diversity.
Dependencies are inferred from the claim text.