Machine-learning based dns fidelity monitoring and behavioral anomaly detection for computer security

An server for improving computer security of utilizing DNS-based monitoring, the server comprising:

• a communication interface configured to send and receive data over a network;
• a memory configured to store historical behavior data for a plurality of entities including at least customers and vendors, the historical behavior data including prior requests and corresponding outcomes for the plurality of entities and historical DNS record information for domains associated with the plurality of entities;
• and
• one or more processors communicatively coupled to the communication interface and the memory, the one or more processors configured to execute a machine learning algorithm and to:
• receive, via the communication interface, a plurality of requests associated with the plurality of entities, the requests being associated with email accounts of the plurality of entities;
• determine, using the machine learning algorithm and based on at least a portion of the historical behavior data, a range of predictable requests for a particular entity of the plurality of entities;
• receive, via the communication interface, a new request associated with the particular entity;
• compare, using the machine learning algorithm, the new request to the range of predictable requests for the particular entity;
• determine, based on the comparison, that the new request varies from the range of predictable requests or is inconsistent with past behaviors of the particular entity;
• and
• in response to the determination, cause a confirmation message to be sent from the communication interface to at least one communication method associated with the particular entity prior to authorizing completion of a secure operation associated with the new request.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a server having a communication interface and a memory, cause the server to perform a method comprising:

• receiving a plurality of requests associated with a plurality of entities including at least customers and vendors, the requests being associated with email accounts of the plurality of entities;
• storing historical behavior data for the plurality of entities, the historical behavior data including prior requests and corresponding outcomes for the plurality of entities and historical DNS record information for domains associated with the plurality of entities;
• utilizing a machine learning algorithm to determine, based on at least a portion of the historical behavior data, a range of predictable requests for a particular entity of the plurality of entities;
• receiving a new request associated with the particular entity;
• comparing, by the machine learning algorithm, the new request to the range of predictable requests for the particular entity;
• determining, based on the comparing, that the new request varies from the range of predictable requests or is inconsistent with past behaviors of the particular entity;
• and
• in response to determining that the new request varies from the range of predictable requests or is inconsistent with past behaviors of the particular entity, causing a confirmation message to be sent to at least one communication method associated with the particular entity prior to authorizing completion of a secure operation associated with the new request.