Behavioral DNS tunneling identification

An apparatus for protecting a computing system, comprising:

• a network interface card (NIC);
• and
• at least one processor configured:
• to extract, via the NIC from data traffic transmitted over a data network connecting a plurality of computing devices to multiple Internet hosting services, respective sets of transmissions from the computing devices to the Internet hosting services,
• to identify, in a given set of the transmissions from a given computing device, multiple domain name system (DNS) requests for an identical second-level domain (2LD) and for different respective sub-domains within the 2LD,
• to compute a number of the different sub-domains within the 2LD and a data size of the multiple DNS requests,
• to compare the computed number of the different sub-domains to a first threshold,
• to compare the computed data size to a second threshold, and
• when the computed number of the different sub-domains exceeds the first threshold and the data size of the multiple DNS requests exceeds the second threshold, to initiate a preventive action to inhibit DNS tunneling from at least the given computing device.

A computer software product for protecting a computing system, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to extract, from data traffic transmitted over a data network connecting a plurality of computing devices to multiple Internet hosting services, respective sets of transmissions from the computing devices to the Internet hosting services;
• to identify, in a given set of the transmissions from a given computing device, multiple domain name system (DNS) requests for an identical second-level domain (2LD) and for different respective sub-domains within the 2LD;
• to compute a number of the different sub-domains within the 2LD and a data size of the multiple DNS requests;
• to compare the computed number of the different sub-domains to a first threshold;
• to compare the computed data size to a second threshold;
• and
• when the computed number of the different sub-domains exceeds the first threshold and the data size of the multiple DNS requests exceeds the second threshold, to initiate a preventive action to inhibit DNS tunneling from at least the given computing device.