DNS recursive PTR signals analysis

A cloud defense system comprising:

• one or more storage media storing instructions;
• one or more processors configured to execute the instructions to cause the cloud defense system to;
• monitor reverse DNS traffic associated with a monitored environment to obtain raw data, the reverse DNS traffic comprising a set of one or more reverse DNS resolver requests originating from the monitored environment and a set of one or more responses generated by one or more DNS resolvers in response to the set of one or more reverse DNS resolver requests, wherein the raw data includes data related to the set of one or more reverse DNS resolver requests and the set of one or more responses;
• generate, using the raw data, augmented data by obtaining at least a portion of the augmented data from a registrar based at least in part on the raw data, or organizing the raw data across a dimension of the raw data;
• determine, based at least in part on the augmented data, that a baseline network activity has been exceeded;
• and
• generate, based at least in part on the determination that the baseline network activity has been exceeded, one or more alerts or one or more reports, or identify one or more patterns in the augmented data.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions when executed by one or more processors cause processing to be performed comprising:

• monitoring, by a cloud defense system, reverse DNS traffic associated with a monitored environment, the reverse DNS traffic comprising a set of one or more reverse DNS resolver requests originating from the monitored environment and a set of one or more responses generated by one or more DNS resolvers in response to the set of one or more reverse DNS resolver requests;
• collecting, by the cloud defense system, and storing raw data based upon the monitoring of the reverse DNS traffic, the raw data including data related to the set of one or more reverse DNS resolver requests and the set of one or more responses;
• augmenting, by the cloud defense system, the raw data to generate augmented data, wherein augmenting the raw data includes obtaining at least a portion of the augmented data from a registrar based at least in part on the raw data, or includes organizing the raw data across a dimension of the raw data;
• identifying, by the cloud defense system, an irregular network activity associated with the monitored environment by determining, based at least in part on the augmented data, that a baseline network activity has been exceeded;
• and
• outputting, by the cloud defense system, a signal indicative of the irregular network activity.