Detecting and alerting on domain fronting within a network
This disclosure describes techniques and mechanisms for detecting and alerting on domain fronting within a network using network location context. Popular services are often hosted by multiple CDNs to increase resiliency and decrease latency. The techniques described herein utilize this insight to identify anomalous encrypted sessions by first creating a baseline of domain name resolutions for a given customer site. The techniques may then look for encrypted sessions destined to an IP address that is anomalous for the given domain name and is known to support domain fronting.
1 . A method for detecting and alerting on domain fronting, the method comprising:
collecting, from one or more devices within a network, Domain Name System (DNS) response data associated with a domain name associated with plurality of network sites of a service provider of the network;
generating, based at least in part on the DNS response data, a baseline indicating Internet Protocol (IP) addresses for one or more servers or hosting providers utilized to host the domain name;
receiving network data associated with network traffic destined for the domain name;
identifying, based at least in part on the baseline and the network traffic, one or more connections having a destination IP address that is atypical relative to other connections to the one or more servers or hosting providers;
performing a DNS query to a DNS server previously used by an endpoint associated with the connection to obtain expected IP addresses for the domain name;
determining, based in part on the destination IP address for the connection not being included in the expected IP addresses, that the one or more connections are correlated with domain fronting; and
generating, based at least in part on the determining, an alert.
2 . The method of claim 1 , wherein the DNS response data comprises one or more domain name system (DNS) responses from one or more providers and one or more IP addresses, and DNS response data associated with one or more DNS fields.
3 . The method of claim 1 , wherein the network data comprises a plurality of connections between the domain name and one or more hosting providers, the network data further including indications of an IP address, a domain name, a round trip time, or a time to live.
4 . The method of claim 1 , wherein the baseline comprises indications of an infrastructure for hosting services selected by endpoint devices associated with the domain name.
5 . The method of claim 1 , wherein generating the alert further comprises utilizing one or more intelligence feeds to determine a level of severity to include in the alert.
6 . The method of claim 1 , wherein the alert is generated based at least in part on one or more of:
(i) determining the one or more connections are to a first hosting provider that is different from second connections to a second hosting provider associated with the domain name;
(ii) determining the one or more connections are associated with a hosting provider that supports domain fronting;
(iii) a round trip time associated with the one or more connections; or
(iv) a time to live associated with the one or more connections.
7 . The method of claim 1 , further comprising:
determining the one or more connections are associated with a particular hosting provider that supports domain fronting; and
blocking the one or more connections to the hosting provider.
8 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
collecting, from one or more devices within a network, Domain Name System (DNS) response data associated with a domain name associated with plurality of network sites of a service provider of the network;
generating, based at least in part on the DNS response data, a baseline including indications of Internet Protocol (IP) addresses for services or hosting providers utilized to host the domain name;
receiving network data associated with network traffic destined for the domain name;
identifying, based at least in part on the baseline and the network traffic, one or more connections having a destination IP address that is atypical relative to other connections to the services or hosting providers;
performing a DNS query to a DNS server previously used by an endpoint associated with the connection to obtain expected IP addresses for the domain name;
determining, based in part on the destination IP address for the connection not being included in the expected IP addresses, that the one or more connections are correlated with domain fronting; and
generating, based at least in part on the determining, an alert.
9 . The system of claim 8 , wherein the DNS response data comprises one or more domain name system (DNS) responses from one or more providers and one or more IP addresses, and DNS data associated with one or more DNS fields.
10 . The system of claim 8 , wherein the network data comprises a plurality of connections between the domain name and one or more hosting providers, the network data further including indications of an IP address, a domain name, a round trip time, or a time to live.
11 . The system of claim 8 , wherein the baseline comprises indications of an infrastructure for hosting services selected by endpoint devices associated with the domain name.
12 . The system of claim 8 , wherein the destination IP address being atypical relative to the other connections indicates suspicious activity that corresponds to domain fronting, and wherein identifying the suspicious activity is based at least in part on:
determining that a connection of the one or more connections is between a device and a domain utilizes a hosting provider or a server that is atypical.
13 . The system of claim 8 , wherein the alert is generated based at least in part on one or more of:
(i) determining the one or more connections are to a hosting provider that is different from second connections to a second hosting provider associated with the domain name;
(ii) determining the one or more connections are associated with a hosting provider that supports domain fronting;
(iii) a round trip time associated with the one or more connections; or
(iv) a time to live associated with the one or more connections.
14 . The system of claim 8 , the operations further comprising:
determining the one or more connections are associated with a hosting provider that supports domain fronting; and
blocking the one or more connections to the hosting provider.
15 . One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
collecting, from one or more devices within a network, Domain Name System (DNS) response data associated with a domain name associated with plurality of network sites of a service provider of the network;
generating, based at least in part on the DNS response data, a baseline including indications of Internet Protocol (IP) addresses for services or hosting providers utilized to host the domain name;
receiving network data associated with network traffic destined for the domain name;
identifying, based at least in part on the baseline and the network traffic, one or more connections having a destination IP address that is atypical relative to other connections to the services or hosting providers;
performing a DNS query to a DNS server previously used by an endpoint associated with the connection to obtain expected IP addresses for the domain name;
determining, based in part on the destination IP address for the connection not being included in the expected IP addresses, that the one or more connections are correlated with domain fronting; and
generating, based at least in part on the determining, an alert.
16 . The one or more non-transitory computer-readable media of claim 15 , wherein the data comprises one or more domain name system (DNS) responses from one or more providers and one or more IP addresses, and DNS data associated with one or more DNS fields.
17 . The one or more non-transitory computer-readable media of claim 15 , wherein the network data comprises a plurality of connections between the domain name and one or more hosting providers and indications of an IP address, a domain name, a round trip time, or a time to live.
18 . The one or more non-transitory computer-readable media of claim 15 , wherein generating the baseline comprises generating, using a plurality of domain name system responses received by the domain name, a histogram of a plurality of IP addresses, associated autonomous systems, and one or more DNS fields.
19 . The one or more non-transitory computer-readable media of claim 15 , wherein the baseline comprises indications of an infrastructure for hosting services selected by endpoint devices associated with the domain name.
20 . The one or more non-transitory computer-readable media of claim 15 , wherein the alert is generated based at least in part on one or more of:
determining the one or more connections are to a hosting provider that is different from second connections to a second hosting provider associated with the domain name;
(ii) determining the one or more connections are associated with a hosting provider that supports domain fronting;
(iii) a round trip time associated with the one or more connections; or
(iv) a time to live associated with the one or more connections.