Behavior analysis based DNS tunneling detection and classification framework for network security
AssigneeInfoblox Inc.
InventorsBin Yu, Les Smith, Mark Threefoot
Life of this patent
Estimating the term…
Abstract
New and improved techniques for a behavior analysis based DNS tunneling detection and classification framework for network security are disclosed. In some embodiments, a platform implementing an analytics framework for DNS security is provided for facilitating DNS tunneling detection. For example, an online platform can implement an analytics framework for DNS security based on passive DNS traffic analysis.
Claims20
A system for an online platform for implementing a behavior analysis based DNS tunneling detection and classification framework for network security, comprising:
- a processor configured to:
- receive a Domain Name Server (DNS) data stream;
- process the DNS data stream to identify DNS tunneling activity based on a behavioral analysis model applied to a time series collection of passive DNS traffic data, comprising to:
- perform the following DNS feature extractions to be input into the behavioral analysis model:
- perform at least one of the following:
- determine entropy of a text string in the DNS data stream based on a distribution of a character set within the text;
- string;
- or
- determine a lexical feature based on human readable characters and non-human readable characters within a text string, wherein the human readable characters include alphabet characters;
- and
- determine a value in a percentile of an N-gram score distribution from a text string in the DNS data stream, wherein the percentile is determined based on a character set within a text string, and wherein N is an integer greater than or equal to 2;
- and
- perform a mitigation action based on the identified DNS tunneling activity;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method of an online platform for implementing a behavior analysis based DNS tunneling detection and classification framework for network security, comprising:
- receiving a Domain Name Server (DNS) data stream;
- processing the DNS data stream using a processor to identify DNS tunneling activity based on a behavioral analysis model applied to a time series collection of passive DNS traffic data, comprising:
- performing the following DNS feature extractions to be input into the behavioral analysis model:
- performing at least one of the following:
- determining entropy of a text string in the DNS data stream based on a distribution of a character set within the text string;
- or
- determining a lexical feature based on human readable characters and non-human readable characters within a text string, wherein the human readable characters include alphabet characters;
- and
- determining a value in a percentile of an N-gram score distribution from a text string in the DNS data stream, wherein the percentile is determined based on a character set within a text string, and wherein N is an integer greater than or equal to 2;
- and
- performing a mitigation action based on the identified DNS tunneling activity.
A computer program product for an online platform for implementing a behavior analysis based DNS tunneling detection and classification framework for network security, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- receiving a Domain Name Server (DNS) data stream;
- processing the DNS data stream to identify DNS tunneling activity based on a behavioral analysis model applied to a time series collection of passive DNS traffic data, comprising:
- performing the following DNS feature extractions to be input into the behavioral analysis model:
- performing at least one of the following:
- determining entropy of a text string in the DNS data stream based on a distribution of a character set within the text string;
- or
- determining a lexical feature based on human readable characters and non-human readable characters within a text string, wherein the human readable characters include alphabet characters;
- and
- determining a value in a percentile of an N-gram score distribution from a text string in the DNS data stream, wherein the percentile is determined based on a character set within a text string, wherein the N-gram score distribution is determined based on historical publications, and wherein N is an integer greater than or equal to 2;
- and
- performing a mitigation action based on the identified DNS tunneling activity.
Dependencies are inferred from the claim text.