Back to results
US 12,764,126 B2Granted
Real-time detection of DNS tunneling traffic
AssigneePalo Alto Networks, Inc.
InventorsDaiping Liu, Jun Wang, Martin Walter, Fan Fei, Wei Xu
Life of this patent
Estimating the term…
Abstract
Detection of DNS tunneling traffic is disclosed. A DNS query comprising a subdomain portion and a root domain portion is received from a client device. A determination is made that the root domain portion received in the DNS query is associated with a malicious DNS tunneling root domain. A remedial action is taken in response to the determining.
Claims31
A system, comprising:
- a processor configured to:
- receive, from a client device, a DNS query comprising:
- (1) a subdomain portion and (2) a root domain portion;
- determine that the root domain portion received in the DNS query is associated with a malicious DNS tunneling root domain, wherein the determination is based at least in part on receiving information obtained from a similarity detector, wherein the similarity detector is configured to:
- use a stored set of previously determined regular expressions previously extracted from a set of known malicious DNS tunneling messages associated with at least one previously identified malicious DNS tunneling root domain, wherein the set of previously determined regular expressions represent one or more patterns corresponding to at least one encoding scheme usable to encode and subsequently decode a DNS tunnelable message;
- and
- take a remedial action in response to the determining, including by preventing the client device from communicating with a node associated with the DNS query;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method, comprising:
- receiving, from a client device, a DNS query comprising:
- (1) a subdomain portion and (2) a root domain portion;
- determining that the root domain portion received in the DNS query is associated with a malicious DNS tunneling root domain, wherein the determination is based at least in part on receiving information obtained from a similarity detector, wherein the similarity detector is configured to:
- use a stored set of previously determined regular expressions previously extracted from a set of known malicious DNS tunneling messages associated with at least one previously identified malicious DNS tunneling root domain, wherein the set of previously determined regular expressions represent one or more patterns corresponding to at least one encoding scheme usable to encode and subsequently decode a DNS tunnelable message;
- and
- taking a remedial action in response to the determining, including by preventing the client device from communicating with a node associated with the DNS query.
3 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving, from a client device, a DNS query comprising:
- (1) a subdomain portion and (2) a root domain portion;
- determining that the root domain portion received in the DNS query is associated with a malicious DNS tunneling root domain, wherein the determination is based at least in part on receiving information obtained from a similarity detector, wherein the similarity detector is configured to:
- use a stored set of previously determined regular expressions previously extracted from a set of known malicious DNS tunneling messages associated with at least one previously identified malicious DNS tunneling root domain, wherein the set of previously determined regular expressions represent one or more patterns corresponding to at least one encoding scheme usable to encode and subsequently decode a DNS tunnelable message;
- and
- taking a remedial action in response to the determining, including by preventing the client device from communicating with a node associated with the DNS query.
3 more elements
Dependencies are inferred from the claim text.