Detection of DNS (domain name system) tunneling and exfiltration through DNS query analysis
AssigneeCisco Technology, Inc.
InventorBrad J. Antoniewicz
Life of this patent
Estimating the term…
Abstract
In one embodiment, a method includes collecting DNS (Domain Name System) communications, analyzing the DNS communications, and identifying DNS tunneling or exfiltration based analysis of the DNS communications. Analyzing the DNS communications includes identifying a distinct query count for each of a plurality of clients over a specified time period and a data transfer direction between the clients and one or more servers, and categorizing the DNS communications based on session features associated with at least one of query type, transfer capability, and server response. An apparatus and logic are also disclosed herein.
Claims20
Logic encoded on one or more non-transitory computer readable media for execution and when executed operable to perform operations including:
- analyzing DNS communications;
- and
- identifying DNS tunneling or exfiltration based on analysis of said DNS communications,
- wherein analyzing said DNS communications comprises:
- identifying a distinct query count associated with a particular registered level domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers,
- categorizing said DNS communications based on session features associated with at least one of query type, transfer capability, and server response, and
- determining if at least a particular percentage of the DNS communications is represented by each of a plurality of query types.
An apparatus comprising:
- a memory for storing DNS communications;
- and
- a DNS communications analyzer for identifying DNS tunneling or exfiltration based on analysis of said DNS communications, the DNS communications analyzer is configured to analyze the DNS communications by:
- identifying a distinct query count associated with a particular registered level domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers,
- categorizing said DNS communications based on session features associated with at least one of query type, transfer capability, and server response;
- and
- determining if at least a particular percentage of the DNS communications is represented by each of a plurality of query types.
A method comprising:
- analyzing DNS communications;
- and
- identifying DNS tunneling or exfiltration based on analysis of the DNS communications,
- wherein analyzing the DNS communications includes:
- identifying a distinct query count associated with a particular registered level domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers,
- categorizing said DNS communications based on session features associated with at least one of query type, transfer capability, and server response;
- and
- determining if at least a particular percentage of the DNS communications is represented by each of a plurality of query types.
Dependencies are inferred from the claim text.