Host level detect mechanism for malicious DNS activities
A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.
1. A computer-implemented method for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts, the method comprising:
gathering, by a set of DNS resolver agents, DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries;
associating, by the set of DNS resolver agents, the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries; and
detecting, by a backend server, one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs;
wherein the associating, by the set of DNS resolver agents, the DNS activities with the PIDs comprises at least one of:
(i) labeling, by a kernel in at least one of the DNS resolver agents, the DNS activities, including system wide network DNS activities, with associated ones of the PIDs using a process table data structure; (ii) accessing, by at least one of the DNS resolver agents, a DNS service that records the DNS activities and associated ones of the PIDs using an Event Tracing for Windows (ETW) channel; and (iii) at least one of the DNS resolver agents gathers the DNS activities using a first channel corresponding to a program that makes indirect DNS calls and a second channel corresponding to one or more programs that makes direct DNS calls from among the programs that issues the DNS queries.
2. The computer-implemented method of claim 1 , further comprising embedding, by an operating system kernel comprised in at least one of the DNS resolver agents, the PIDs into a communication packet buffer and capturing packets that include the DNS queries and the DNS responses.
3. The computer-implemented method of claim 1 , wherein the backend server is configured to perform machine learning based detection of the malicious DNS activities.
4. The computer-implemented method of claim 1 , further comprising identifying, by the backend server, an infected host and a responsible one of the programs, responsive to a detection of the one or more of the malicious DNS activities.
5. The computer-implemented method of claim 4 , further comprising identifying, by the backend server, neighboring DNS queries relative to a particular one of the DNS queries associated with the one or more of the malicious DNS activities.
6. The computer-implemented method of claim 1 , further comprising labelling, by the backend server, Internet Protocol (IP) addresses of the multiple end-hosts with associated DNS names.
7. A system for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts, the system comprising:
a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries; and
a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs;
wherein the associating the DNS activities with the PIDs comprises at least one of:
(i) at least one of the DNS resolver agents comprises a kernel configured to label the DNS activities, including system wide network DNS activities, with associated ones of the PIDs using a process table data structure; (ii) at least one of the DNS resolver agents is configured to access a DNS service that records the DNS activities and associated ones of the PIDs using an Event Tracing for Windows (ETW) channel; and (iii) at least one of the DNS resolver agents is configured to gather the DNS activities using a first channel corresponding to a program that makes indirect DNS calls and a second channel corresponding to one or more programs that makes direct DNS calls from among the programs that issues the DNS queries.
8. The system of claim 7 , wherein at least one of the DNS resolver agents comprises an operating system kernel configured to embed the PIDs into a communication packet buffer and capture packets that include the DNS queries and the DNS responses.
9. The system of claim 7 , wherein the backend server is configured to perform machine learning based detection of the malicious DNS activities.
10. The system of claim 7 , wherein the backend server is further configured to identify an infected host and a responsible one of the programs, responsive to a detection of the one or more of the malicious DNS activities.
11. The system of claim 10 , wherein the backend server is further configured to identify neighboring DNS queries relative to a particular one of the DNS queries associated with the one or more of the malicious DNS activities.
12. The system of claim 7 , wherein the backend server is further configured to integrate the system with one or more other systems for detecting the malicious DNS activities using a host name and a PID for each of the multiple hosts as key fields for integration.
13. The system of claim 7 , wherein the backend server is further configured to label Internet Protocol (IP) addresses of the multiple end-hosts with associated DNS names.
14. A computer program product for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
gathering, by a set of DNS resolver agents, DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries;
associating, by the set of DNS resolver agents, the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries; and
detecting, by a backend server, one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs;
wherein the associating, by the set of DNS resolver agents, the DNS activities with the PIDs comprises at least one of:
(i) labeling, by a kernel in at least one of the DNS resolver agents, the DNS activities, including system wide network DNS activities, with associated ones of the PIDs using a process table data structure; (ii) accessing, by at least one of the DNS resolver agents, a DNS service that records the DNS activities and associated ones of the PIDs using an Event Tracing for Windows (ETW) channel; and (iii) at least one of the DNS resolver agents gathers the DNS activities using a first channel corresponding to a program that makes indirect DNS calls and a second channel corresponding to one or more programs that makes direct DNS calls from among the programs that issues the DNS queries.