Applying natural language processing anomaly measures as features for DNS tunneling detection
AssigneeInfoblox Inc.
InventorDarin Johnson
Life of this patent
Estimating the term…
Abstract
Various techniques for applying natural language processing (NLP) as features for DNS tunneling detection are disclosed. In some embodiments, a system/process/computer program product for applying natural language processing as features for DNS tunneling detection includes aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy.
Claims15
A system, comprising:
- a processor configured to:
- aggregate DNS traffic from one or more networks;
- automatically classify the aggregated DNS traffic to detect DNS tunneling activity, comprising to:
- determine a count of a number of times a given n-gram is extracted from the aggregated DNS traffic;
- determine an anomaly score based on the count;
- input the anomaly score into a tunneling model to generate a DNS tunneling score, wherein the tunneling model implements a random forest technique;
- determine that the DNS tunneling score is equal to or greater than a predetermined threshold;
- and
- in response to a determination that the DNS tunneling score is equal to or greater than the predetermined threshold, add a domain associated with the aggregated DNS traffic to a block list;
- and
- perform an action based on the detected DNS tunneling activity based on a policy, comprising to:
- block the domain in near real-time at a DNS security platform;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- aggregating DNS traffic from one or more networks;
- automatically classifying the aggregated DNS traffic to detect DNS tunneling activity, comprising:
- determining a count of a number of times a given n-gram is extracted from the aggregated DNS traffic;
- determining an anomaly score based on the count;
- inputting the anomaly score into a tunneling model to generate a DNS tunneling score, wherein the tunneling model implements a random forest technique;
- determining that the DNS tunneling score is equal to or greater than a predetermined threshold;
- and
- in response to a determination that the DNS tunneling score is equal to or greater than the predetermined threshold, adding a domain associated with the aggregated DNS traffic to a block list;
- and
- performing an action based on the detected DNS tunneling activity based on a policy, comprising:
- blocking the domain in near real-time at a DNS security platform.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- aggregating DNS traffic from one or more networks;
- automatically classifying the aggregated DNS traffic to detect DNS tunneling activity, comprising:
- determining a count of a number of times a given n-gram is extracted from the aggregated DNS traffic;
- determining an anomaly score based on the count;
- inputting the anomaly score into a tunneling model to generate a DNS tunneling score, wherein the tunneling model implements a random forest technique;
- determining that the DNS tunneling score is equal to or greater than a predetermined threshold;
- and
- in response to a determination that the DNS tunneling score is equal to or greater than the predetermined threshold, adding a domain associated with the aggregated DNS traffic to a block list;
- and
- performing an action based on the detected DNS tunneling activity based on a policy, comprising:
- blocking the domain in near real-time at a DNS security platform.
Dependencies are inferred from the claim text.