PACKET LOGGING
Systems and methods associated with packet logging are described. One example method includes testing a packet obtained from a packet stream against a whitelist and a blacklist. The method also includes dropping the packet when the packet tests positive against the whitelist. The method also includes providing the packet to a security manager when the packet tests positive against the blacklist. The method also includes logging the packet when the packet tests negative against the whitelist.
1 . A non-transitory computer-readable medium storing computer-executable instructions that when executed by a computer cause the computer to:
test a packet obtained from a packet stream against a whitelist and a blacklist;
drop the packet when the packet tests positive against the whitelist;
log the packet when the packet tests negative against the whitelist; and
provide the packet to a security manager when the packet tests positive against the blacklist.
2 . The non-transitory computer-readable medium of claim 1 , wherein the packet stream includes packets traveling between a domain name system (DNS) server and a set of clients in communication with the DNS server, and wherein the packet is a DNS packet.
3 . The non-transitory computer-readable medium of claim 1 , wherein the whitelist comprises benign domains and benign internet protocol (IP) addresses, and wherein the blacklist comprises malicious domains and malicious IP addresses.
4 . The non-transitory computer-readable medium of claim 1 , wherein the whitelist comprises low priority clients and low priority applications, and wherein the blacklist comprises high priority clients and high priority applications.
5 . The non-transitory computer-readable medium of claim 1 , wherein the whitelist comprises benign signatures that indicate a packet is associated with a benign event and wherein the blacklist comprises attack signatures that indicate a packet is associated with a malicious event.
6 . The non-transitory computer-readable medium of claim 1 , wherein logging the packet comprises extracting security information from the packet and storing the packet and the extracted security information for future analysis.
7 . A system, comprising:
a classification logic to classify domain name system (DNS) packets as benign, malicious, and unknown based on a whitelist and a blacklist;
a logging logic to store unknown classified DNS packets and malicious classified DNS packets for subsequent analysis; and
a security management logic to generate an alert based on one of the malicious classified DNS packets.
8 . The system of claim 7 , wherein the subsequent analysis is performed in response to detection of a malicious event and where the subsequent analysis identifies attributes of the malicious event to facilitate blocking events sharing the attributes of the malicious event.
9 . The system of claim 7 , comprising a packet filtering logic to provide DNS packets from a set of packets to the classification logic.
10 . The system of claim 9 , comprising a packet copier to provide the set of packets to the packet filtering logic, wherein the set of packets is obtained from packets traveling between a DNS server and clients communicating with the DNS server.
11 . The system of claim 10 , wherein the packet copier is one of a network tap, and a port mirror.
12 . The system of claim 7 , wherein the alert indicates an attack against a network protected by the system, and a course of action to take to protect the network against the attack.
13 . The system of claim 7 , wherein a classified DNS packets is classified as benign when a domain associated with the classified DNS packet appears on the whitelist, wherein the classified DNS packet is classified as malicious if a domain associated with the classified DNS packet appears on the blacklist, and wherein the classified DNS packet is classified as unknown if a domain associated with the classified DNS packet does not appear on the whitelist and does not appear on the blacklist.
14 . A non-transitory computer-readable medium storing computer-executable instructions that when executed by a computer cause the computer to:
drop a domain name system (DNS) packet when an attribute with which the packet is associated matches a whitelisted attribute;
generate an alert regarding the DNS packet when an attribute with which the packet is associated matches a blacklisted attribute; and
log information regarding the DNS packet when the packet has no whitelisted attributes.
15 . The non-transitory computer-readable medium of claim 14 , where the DNS packet is copied for out of band analysis from a packet stream between a DNS server and a client in communication with the DNS server.