# US 2025/0097245 A1 · Applying natural language processing anomaly measures as features for dns tunneling detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097245 A1 - Document ID: US20250097245A1 - Status: Published application - Kind: A1 - Application number: 18/753,950 - Filed: 2024-06-25 - Published: 2025-03-20 - Earliest claimed: 2023-09-15 - Assignees: Infoblox Inc. - Applicants: Infoblox Inc. - Inventors: Darin Johnson - Web page: https://patentgrep.com/patent/US20250097245A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 61/4511: using domain name system [DNS] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various techniques for applying natural language processing (NLP) as features for DNS tunneling detection are disclosed. In some embodiments, a system/process/computer program product for applying natural language processing as features for DNS tunneling detection includes aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy. ## Claims ### Claim 1 A system, comprising: a processor configured to: aggregate DNS traffic from one or more networks; automatically classify the aggregated DNS traffic to detect DNS tunneling activity; and perform an action based on the detected DNS tunneling activity based on a policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier. ### Claim 3 (depends on 1) The system recited in claim 1, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for neural network anomaly detection using an autoencoder. ### Claim 4 (depends on 1) The system recited in claim 1, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for n-gram anomaly detection using an isolation forest. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the aggregated DNS traffic is collected from a plurality of monitored enterprise, university, and/or government networks. ### Claim 6 (depends on 1) The system recited in claim 1, wherein a new threat domain is identified based on being associated with the detected DNS tunneling activity. ### Claim 7 (depends on 1) The system recited in claim 1, wherein a domain is identified as associated with the detected DNS tunneling activity, and wherein an action is performed based on the policy. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: identify a domain as associated with the detected DNS tunneling activity. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: block a domain in near real-time at a DNS security platform, wherein the domain is associated with the detected DNS tunneling activity, and wherein the domain is blocked at least for a predetermined period of time. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: report a domain, wherein the domain is associated with the detected DNS tunneling activity. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: add a domain to a block list, wherein the domain is associated with the detected DNS tunneling activity. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: quarantine a domain, wherein the domain is associated with the detected DNS tunneling activity. ### Claim 13 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: automatically generate a new DNS signature for a domain, wherein the domain is associated with the detected DNS tunneling activity. ### Claim 14 A method, comprising: aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy. ### Claim 15 (depends on 14) The method of claim 14, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier. ### Claim 16 (depends on 14) The method of claim 14, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for neural network anomaly detection using an autoencoder. ### Claim 17 (depends on 14) The method of claim 14, wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for n-gram anomaly detection using an isolation forest. ### Claim 18 (depends on 14) The method of claim 14, wherein the aggregated DNS traffic is collected from a plurality of monitored enterprise, university, and/or government networks. ### Claim 19 (depends on 14) The method of claim 14, wherein a new threat domain is identified based on being associated with the detected DNS tunneling activity. ### Claim 20 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy.