Systems and methods to detect and monitor dns tunneling
AssigneeZscaler, Inc.
InventorsSushil Pangeni, Vladimir Stepanenko, Ravinder Verma, Srikanth Devarajan
Life of this patent
Estimating the term…
Abstract
Systems and methods of detecting Domain Name System (DNS) tunnels for monitoring thereof include obtaining data related to DNS traffic between DNS nameservers and clients; determining a score for each DNS nameserver based on the data to characterize DNS queries over a period of time for each DNS nameserver, wherein the score incorporates all DNS queries associated with the associated DNS nameserver over the period of time; determining one or more DNS nameservers likely operating DNS tunnels based on the score; and performing one or more actions on the one or more DNS nameservers related to the DNS tunnels.
Claims20
A method of detecting Domain Name System (DNS) tunnels for monitoring thereof, the method comprising:
- obtaining data related to DNS traffic between DNS nameservers and clients;
- determining a score for each DNS nameserver based on the data to characterize DNS queries over a period of time for each DNS nameserver, wherein the score incorporates all DNS queries associated with the associated DNS nameserver over the period of time;
- determining one or more DNS nameservers likely operating DNS tunnels based on the score;
- and
- performing one or more actions on the one or more DNS nameservers related to the DNS tunnels.
A Domain Name System (DNS) tunnel detection system, the DNS tunnel detection system comprising:
- a network interface;
- a processor communicatively coupled to the network interface;
- and
- memory storing instructions that, when executed, cause the processor to:
- obtain data related to DNS traffic between DNS nameservers and clients;
- determine a score for each DNS nameserver based on the data to characterize DNS queries over a period of time for each DNS nameserver, wherein the score incorporates all DNS queries associated with the associated DNS nameserver over the period of time;
- determine one or more DNS nameservers likely operating DNS tunnels based on the score;
- and
- provide the one or more DNS nameservers likely operating DNS tunnels to a distributed security system for performance of one or more actions related to the DNS tunnels.
A distributed security system configured to detect and monitor Domain Name System (DNS) tunnels, the distributed security system comprising:
- one or more cloud nodes operating as DNS proxies for one or more clients;
- a log node communicatively coupled to the one or more cloud nodes;
- and
- a DNS tunneling detection system communicatively coupled to the one or more cloud nodes and the log node, wherein the DNS tunneling detection system is configured to
- obtain data related to DNS traffic between DNS nameservers and clients from the log node;
- determine a score for each DNS nameserver based on the data to characterize DNS queries over a period of time for each DNS nameserver, wherein the score incorporates all DNS queries associated with the associated DNS nameserver over the period of time;
- determine one or more DNS nameservers likely operating DNS tunnels based on the score;
- and
- provide the one or more DNS nameservers likely operating DNS tunnels to the one or more cloud nodes for performance of one or more actions related to the DNS tunnels.
Dependencies are inferred from the claim text.