Domain name and dns record analysis for dns tunneling detection

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

• based on detection of Domain Name System (DNS) traffic, identify a first domain name indicated in the DNS traffic;
• generate a pattern covering a plurality of domain names that includes the first domain name based on categorization of components of the plurality of domain names, wherein additional ones of the plurality of domain names are identified in passive DNS data obtained for a first timeframe, wherein the instructions to generate the pattern comprise instructions to,
• determine that a first component of each of the plurality of domain names is encoded according to a first encoding scheme;
• and
• categorize the first component of each of the plurality of domain names as encoded text corresponding to the first encoding scheme;
• decode components of each of the plurality of domain names categorized as corresponding to the first encoding scheme to obtain first decoded text;
• determine whether the first decoded text is meaningful;
• and
• indicate the pattern representing the first domain name and, based on a determination that the first decoded text is meaningful, a verdict that the first decoded text is meaningful.

An apparatus comprising:

• a processor;
• and
• a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, based on detection of a Domain Name System (DNS) query, identify a first domain name indicated in the DNS query;
• generate a pattern that covers the first domain name and an additional plurality of domain names corresponding to a root domain of the first domain name, wherein the plurality of domain names is identified in passive DNS data obtained for a first timeframe, wherein the instructions to generate the pattern comprise instructions to,
• for each component of the first domain name and the plurality of domain names, determine if the component comprises encoded text;
• and
• based on a determination that the component comprises encoded text, indicate within the pattern a location of text encoded in domain names covered by the pattern and an indication of a corresponding first encoding scheme;
• decode the text encoded in the first domain name and the plurality of domain names at the location indicated in the pattern with a decoding scheme corresponding to the first encoding scheme to obtain first decoded text;
• determine if the first decoded text is meaningful;
• and
• indicate the pattern and whether the first decoded text is meaningful.