Computing device and method of detecting compromised network devices

A computer-implementable method of identifying, in a network infrastructure, compromised network devices that are using DNS tunneling, the method being executable by a computing device including a processor communicatively coupled to the network infrastructure, the method comprising:

• receiving, by the processor, traffic of the network infrastructure;
• identifying, by the processor, from the traffic, a plurality of DNS queries having been generated by network devices of the network infrastructure;
• determining, by the processor, in the plurality of DNS queries, presence of DNS queries to predetermined types of domain names, generation of which, by a respective network device of the network infrastructure, is non-indicative of the respective network devices being compromised;
• removing, by the processor, from the plurality of DNS queries, the DNS queries to the predetermined types of domain names, thereby generating a refined plurality of DNS queries;
• generating, by the processor, for a given one of the refined plurality of DNS queries, a respective set of features;
• applying, by the processor, to the respective set of features associated with the given one of the refined plurality of DNS queries, a pre-trained decision rule,
• the pre-trained decision rule having been trained to determine, based on the respective set of features, whether a respective domain name associated with the given one of the refined plurality of DNS queries is malicious;
• in response to the pre-trained decision rule rendering a positive outcome, increasing a respective penalty score for each network device of the network infrastructure having transmitted the given one of the refined plurality of DNS queries;
• in response to the respective penalty score associated with a given network device exceeding a predetermined penalty score threshold, identifying, by the processor, the given network device as being compromised;
• and
• generating, by the processor, a warning notification for transmission thereof about the given network device being compromised.