Detecting data exfiltration and infiltration over DNS

A computer-program product comprising one or more non-transitory machine-readable storage media, including stored instructions configured to cause a computing system to perform a set of actions including:

• storing a plurality of Domain Name Service (DNS) communications for a DNS server, wherein each DNS communication of the plurality of DNS communications comprises one or more DNS communication characteristics and a content item;
• generating a plurality of clusters of content items from the plurality of DNS communications based at least in part on at least one DNS communication characteristic of the one or more DNS communication characteristics;
• for each cluster of particular content items of the plurality of clusters of content items from the plurality of DNS communications, determining an aggregate amount of information conveyed by the particular content items in the cluster based at least in part on:
• determining, for each unique content item among the particular content items, an individual amount of information based on a number of character possibilities of the unique content item such that the number of character possibilities is determined from:
• a length of the unique content item, and
• a format including a number of different characters used at least once in the unique content item, wherein the unique content item uses only a subset of available characters;
• and
• aggregating the individual amount of information for the particular content items;
• detecting that a particular cluster having a particular one or more values for the at least one DNS communication characteristic has a particular aggregate amount of information that satisfies one or more notification conditions;
• based at least in part on detecting that the particular cluster has the particular aggregate amount of information that satisfies the one or more notification conditions, triggering a notification reporting the particular aggregate amount of information and the particular one or more values for the at least one DNS communication characteristic.

A system comprising:

• one or more processors;
• one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of actions including:
• storing a plurality of Domain Name Service (DNS) communications for a DNS server, wherein each DNS communication of the plurality of DNS communications comprises one or more DNS communication characteristics and a content item;
• generating a plurality of clusters of content items from the plurality of DNS communications based at least in part on at least one DNS communication characteristic of the one or more DNS communication characteristics;
• for each cluster of particular content items of the plurality of clusters of content items from the plurality of DNS communications, determining an aggregate amount of information conveyed by the particular content items in the cluster based at least in part on:
• determining, for each unique content item among the particular content items, an individual amount of information based on a number of character possibilities of the unique content item such that the number of character possibilities is determined from:
• a length of the unique content item, and
• a format including a number of different characters used at least once in the unique content item, wherein the unique content item uses only a subset of available characters;
• and
• aggregating the individual amount of information for the particular content items;
• detecting that a particular cluster having a particular one or more values for the at least one DNS communication characteristic has a particular aggregate amount of information that satisfies one or more notification conditions;
• based at least in part on detecting that the particular cluster has the particular aggregate amount of information that satisfies the one or more notification conditions, triggering a notification reporting the particular aggregate amount of information and the particular one or more values for the at least one DNS communication characteristic.