Name translation monitoring
AssigneeForescout Technologies, Inc.
InventorsOded Comay, Oren Nechushtan
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for analyzing traffic are described. In certain aspects, network traffic is analyzed and a domain name system (DNS) message is extracted from the network traffic. Subsequent network traffic is monitored and analyzed based on the DNS message and in view of one or more criteria. In response to the one or more criteria being satisfied, an indication of compromise (IoC) for a device is determined.
Claims20
A method comprising:
- accessing network traffic;
- extracting, from the network traffic, a domain name system (DNS) message;
- monitoring subsequent network traffic that is associated with a device;
- analyzing, by a processing device, the subsequent network traffic based on the DNS message and in view of one or more criteria, and
- in response to the one or more criteria being satisfied, determining an indication of compromise (IoC) that is associated with the device.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- access network traffic;
- extract, from the network traffic, a domain name system (DNS) message;
- monitor subsequent network traffic that is associated with a device;
- analyze the subsequent network traffic based on the DNS message and in view of one or more criteria, and
- in response to the one or more criteria being satisfied, determine an indication of compromise (IoC) that is associated with the device.
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- access network traffic;
- extract, from the network traffic, a domain name system (DNS) message;
- monitor subsequent network traffic that is associated with a device;
- analyze, by the processing device, the subsequent network traffic based on the DNS message and in view of one or more criteria, and
- in response to the one or more criteria being satisfied, determine an indication of compromise (IoC) that is associated with the device.
Dependencies are inferred from the claim text.