# US 2024/0205240 A1 · Real-time detection of dns infiltration traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205240 A1
- Document ID: US20240205240A1
- Status: Published application
- Kind: A1
- Application number: 18/217,253
- Filed: 2023-06-30
- Published: 2024-06-20
- Earliest claimed: 2022-12-15
- Assignees: Palo Alto Networks, Inc.
- Applicants: Palo Alto Networks, Inc.
- Inventors: Ruian Duan; Daiping Liu; Tingxiang Zhu; Xing Wang; Jun Wang
- Web page: https://patentgrep.com/patent/US20240205240A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Real-time detection of DNS infiltration traffic is disclosed. A DNS response associated with a DNS query sent by a client device is received. An attempted DNS infiltration is detected based at least in part on an automated analysis of the DNS response. In response to the detection, a remedial action is performed.

## Claims

### Claim 1

A system, comprising:
a processor configured to:
receive a DNS response associated with a DNS query sent by a client device;
detect an attempted DNS infiltration based at least in part on an automated analysis of the DNS response; and
in response to the detection, perform a remedial action; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 2 (depends on 1)

The system of claim 1, wherein the DNS response is received, at a server on an external network, from a security appliance collocated with the client device.

### Claim 3 (depends on 1)

The system of claim 1, wherein the processor is configured to perform the detection using at least one model trained on DNS response feature information.

### Claim 4 (depends on 1)

The system of claim 1, wherein the processor is configured to perform the detection using a set of heuristics.

### Claim 5 (depends on 1)

The system of claim 1, wherein performing the remedial action includes including a domain associated with the DNS response in a blocklist.

### Claim 6 (depends on 1)

The system of claim 1, wherein performing the remedial action includes providing a result of the analysis to a security appliance during a session of the client device.

### Claim 7 (depends on 1)

The system of claim 1, wherein performing the remedial action includes preventing the client device from communicating with a malicious DNS server.

### Claim 8 (depends on 1)

The system of claim 1, wherein the processor is configured to perform the analysis based at least in part on a feature vector that maintains information for a sliding time window of DNS information.

### Claim 9 (depends on 8)

The system of claim 8, wherein a feature included in the feature vector represents a number of distinct fully qualified domain names associated with a root domain portion.

### Claim 10 (depends on 1)

The system of claim 1, wherein the analysis includes determining a correlation between a plurality of IP addresses associated with a domain.

### Claim 11 (depends on 1)

The system of claim 1, wherein the analysis includes determining a location of a domain.

### Claim 12 (depends on 1)

The system of claim 1, wherein the analysis includes determining entropy of a set of unique IP addresses.

### Claim 13 (depends on 1)

The system of claim 1, wherein the analysis includes determining whether the DNS response includes a non-public IPv6 address.

### Claim 14 (depends on 1)

The system of claim 1, wherein the analysis includes determining whether data in a TXT response matches a pattern.

### Claim 15 (depends on 1)

The system of claim 1, wherein the analysis includes determining a count of unknown TXT responses.

### Claim 16 (depends on 1)

The system of claim 1, wherein the analysis includes determining an entropy of a set of unique TXT responses.

### Claim 17 (depends on 1)

The system of claim 1, wherein the analysis includes determining a meaningful word ratio.

### Claim 18 (depends on 1)

The system of claim 1, wherein the analysis includes determining a subdomain Jeffrey distribution.

### Claim 19

A method, comprising:
receiving a DNS response associated with a DNS query sent by a client device;
detecting an attempted DNS infiltration based at least in part on an automated analysis of the DNS response; and
in response to the detection, performing a remedial action.

### Claim 20

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a DNS response associated with a DNS query sent by a client device;
detecting an attempted DNS infiltration based at least in part on an automated analysis of the DNS response; and
in response to the detection, performing a remedial action.