System, method, and computer program product for detecting an anomaly in network activity

A system for detecting anomalies in network data, comprising at least one processor programmed or configured to:

• receive data associated with a plurality of Domain Name System (DNS) queries from a plurality of data sources;
• parse the data associated with the plurality of DNS queries to provide DNS query data and network domain data;
• route the DNS query data to a first queue using a queries exchange;
• route the network domain data to a second queue using a domains exchange;
• poll the first queue and the second queue with a microservice application to receive the DNS query data and the network domain data with the microservice application for processing;
• and
• detect a characteristic of one or more DNS queries of the plurality of DNS queries based on the DNS query data and the network domain data, and wherein, when detecting the characteristic of the one or more DNS queries of the plurality of DNS queries, the at least one processor is programmed or configured to:
• store the DNS query data and the network domain data in a time-series database;
• determine a geolocation of a server associated with a domain and a category of the domain based on the DNS query data and the network domain data;
• store the DNS query data, the network domain data, the geolocation of the server, and the category of the domain in a database;
• and
• determine the characteristic of the one or more DNS queries of the plurality of DNS queries based on the DNS query data, the network domain data, the geolocation of the server, and the category of the domain.

A computer program product for detecting anomalies in network data, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:

• receive data associated with a plurality of Domain Name System (DNS) queries from a plurality of data sources;
• parse the data associated with the plurality of DNS queries to provide DNS query data and network domain data;
• route the DNS query data to a first queue using a queries exchange;
• route the network domain data to a second queue using a domains exchange;
• poll the first queue and the second queue with a microservice application to receive the DNS query data and the network domain data with the microservice application for processing;
• and
• detect a characteristic of one or more DNS queries of the plurality of DNS queries based on the DNS query data and the network domain data, and wherein the one or more instructions that cause the at least one processor to detect the characteristic of the one or more DNS queries of the plurality of DNS queries, cause the at least one processor to:
• store the DNS query data and the network domain data in a time-series database;
• determine a geolocation of a server associated with a domain and a category of the domain based on the DNS query data and the network domain data;
• store the DNS query data, the network domain data, the geolocation of the server, and the category of the domain in a database;
• and
• determine the characteristic of the one or more DNS queries of the plurality of DNS queries based on the DNS query data, the network domain data, the geolocation of the server, and the category of the domain.