Time-to-live and latency randomization to defeat timing-based relayed dns infiltration

A non-transitory, machine-readable medium having program code stored thereon, the program code comprising instructions to:

• determine request and response pairs in network traffic between clients in a network and one or more legitimate services;
• identify, from the request and response pairs, domains by root domain or fully qualified domain name;
• filter the domains to filter out trustworthy domains and yield a set of domains;
• for each of the set of domains,
• record latency for each request-response pair that indicates the domain;
• and
• determine a minimum and a maximum of the recorded latencies;
• and
• after determining a minimum latency and a maximum latency for each of the set of domains, monitor traffic between the clients and the one or more legitimate services for requests corresponding to the set of domains;
• and
• while monitoring the traffic, pseudo-randomly select and delay responses to at least a subset of detected requests corresponding to the set of domains, wherein a delayed response is delayed for a time within the minimum and maximum latencies recorded for the one of the set of domains corresponding to the delayed response.

An apparatus comprising:

• a processor;
• and
• a machine-readable medium having stored thereon instructions executable by the processor to cause the apparatus to,
• determine request and response pairs in network traffic between clients in a network and one or more legitimate services;
• identify, from the request and response pairs, domains by root domain or fully qualified domain name;
• filter the domains to filter out trustworthy domains and yield a set of domains;
• for each of the set of domains,
• record latency for each request-response pair that indicates the domain;
• and
• determine a minimum and a maximum of the recorded latencies;
• and
• after determining a minimum latency and a maximum latency for each of the set of domains, monitor traffic between the clients and the one or more legitimate services for requests corresponding to the set of domains;
• and
• while monitoring the traffic, pseudo-randomly select and delay responses to at least a subset of detected requests corresponding to the set of domains, wherein a delayed response is delayed for a time within the minimum and maximum latencies recorded for the one of the set of domains corresponding to the delayed response.