Cognitive and contextual detection of malicious dns

A computer usable program product comprising a computer readable storage device including computer usable code, the computer usable code comprising:

• computer usable code for constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature;
• computer usable code for computing, using the packet, a metadata item supporting the input feature;
• computer usable code for classifying, using a processor and a memory to execute a trained cognitive classification model, and by supplying the input feature and the supporting metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server;
• computer usable code for outputting, from the cognitive classification model, a classification of the packet as malicious, and a confidence value in the malicious classification;
• and
• computer usable code for causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.

A data processing system comprising:

• a storage device, wherein the storage device stores computer usable program code;
• and
• a processor, wherein the processor executes the computer usable program code, and wherein the computer usable program code comprises:
• computer usable code for constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature;
• computer usable code for computing, using the packet, a metadata item supporting the input feature;
• computer usable code for classifying, using a processor and a memory to execute a trained cognitive classification model, and by supplying the input feature and the supporting metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server;
• computer usable code for outputting, from the cognitive classification model, a classification of the packet as malicious, and a confidence value in the malicious classification;
• and
• computer usable code for causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.