Real-time attribution of tools and campaigns for dns tunneling traffic
AssigneePalo Alto Networks, Inc.
InventorsRuian Duan, Daiping Liu, Zihang Xiao
Life of this patent
Estimating the term…
Abstract
Various embodiments provide a system, method, and device for applying a DNS activity classification framework. The method incudes (i) collecting DNS-related activity, (ii) determining whether the DNS-related activity is associated with a DNS tunneling campaign or tool, and (iii) performing an active measure in response to detecting DNS traffic associated with a tunneling domain.
Claims24
A system for classifying DNS tunneling traffic, comprising:
- one or more processors configured to:
- collect DNS-related activity;
- aggregate domain-level data from a plurality of heterogeneous data sources to generate multi-source features for the DNS-related activity;
- determine whether the DNS-related activity is associated with a DNS tunneling campaign or tool based at least in part on the multi-source features;
- and
- handle network traffic based at least in part on (i) detecting DNS traffic associated with a tunneling domain and (ii) a predefined security policy;
- and
- a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.
A method for classifying DNS tunneling traffic, comprising:
- collecting DNS-related activity;
- aggregating domain-level data from a plurality of heterogeneous data sources to generate multi-source features for the DNS-related activity;
- determining whether the DNS-related activity is associated with a DNS tunneling campaign or tool based at least in part on the multi-source features;
- and
- handling network traffic based at least in part on (i) detecting DNS traffic associated with a tunneling domain and (ii) a predefined security policy.
A computer program product embodied in a non-transitory computer readable medium for classifying DNS tunneling traffic, the computer program product comprising computer instructions for:
- collecting DNS-related activity;
- aggregating domain-level data from a plurality of heterogeneous data sources to generate multi-source features for the DNS-related activity;
- determining whether the DNS-related activity is associated with a DNS tunneling campaign or tool based at least in part on the multi-source features;
- and
- handling network traffic based at least in part on (i) detecting DNS traffic associated with a tunneling domain and (ii) a predefined security policy.
Dependencies are inferred from the claim text.