Applying natural language processing anomaly measures as features for dns tunneling detection
AssigneeInfoblox Inc.
InventorDarin Johnson
Life of this patent
Estimating the term…
Abstract
Various techniques for applying natural language processing (NLP) as features for DNS tunneling detection are disclosed. In some embodiments, a system/process/computer program product for applying natural language processing as features for DNS tunneling detection includes aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy.
Claims20
A system, comprising:
- a processor configured to:
- aggregate DNS traffic from one or more networks;
- automatically classify the aggregated DNS traffic to detect DNS tunneling activity;
- and
- perform an action based on the detected DNS tunneling activity based on a policy;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- aggregating DNS traffic from one or more networks;
- automatically classifying the aggregated DNS traffic to detect DNS tunneling activity;
- and
- performing an action based on the detected DNS tunneling activity based on a policy.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- aggregating DNS traffic from one or more networks;
- automatically classifying the aggregated DNS traffic to detect DNS tunneling activity;
- and
- performing an action based on the detected DNS tunneling activity based on a policy.
Dependencies are inferred from the claim text.