Analyzing DNS requests for anomaly detection
A computer-implemented method for detecting anomalies in DNS requests comprises receiving a plurality of DNS requests generated within a predetermined period. The predetermined period includes a plurality of DNS data fragments. The method further includes receiving a first DNS request and selecting a plurality of second DNS requests from the plurality of DNS requests such that each of the second DNS requests is a subset of the first DNS request. The method also includes calculating a count value for each of the DNS data fragments, where each of the count values represents a number of instances the second DNS requests appear within one of the DNS data fragments. In some embodiments, the count values for each of the DNS data fragments can be normalized. The method further includes determining an anomaly trend, for example, based on determining that at least one of the count values exceeds a predetermined threshold value.
1. A computer-implemented method for detecting anomalies in Domain Name System (DNS) requests, the method comprising:
receiving DNS data, the DNS data including a plurality of DNS requests generated within a predetermined period, the predetermined period including a plurality of DNS data fragments;
receiving a selection of a particular DNS request from the plurality of DNS requests, the particular DNS request being a first DNS request (Qi), the first DNS request being associated with a domain name;
selecting a plurality of second DNS requests (Qj) from the plurality of DNS requests, each of the second DNS requests being a subset of the first DNS request;
calculating a count value for each of the DNS data fragments, each of the count values representing a number of instances or frequency the second DNS requests appear within one of the DNS data fragments; and
determining an anomaly trend based on the count values of the plurality of second DNS requests associated with the plurality of the DNS data fragments.
2. The method of claim 1 , further comprising normalizing the count values for each of the DNS data fragments.
3. The method of claim 2 , wherein the normalizing of the count values for each of the DNS data fragments includes:
calculating a total count value for the predetermined period, wherein the total count value represents a number of instances the second DNS requests appear within all of the DNS data fragments; and
normalizing the count values by corresponding norm values.
4. The method of claim 1 , wherein the first DNS request is associated with a domain name, and wherein each of the second DNS requests is associated with the same domain name.
5. The method of claim 1 , wherein the first DNS request is associated with a core domain name, and wherein each of the second DNS requests is associated with the same core domain name.
6. The method of claim 1 , wherein the first DNS request is associated with a domain name and one or more sub-domain names, and wherein each of the second DNS requests is associated with at least one of the same sub-domain names.
7. The method of claim 1 , wherein the first DNS request and each of the second DNS requests are associated with a single DNS network.
8. The method of claim 1 , wherein the first DNS request and each of the second DNS requests are associated with a single Content Delivering Network (CDN).
9. The method of claim 1 , wherein the first DNS request and each of the second DNS requests originate from the same territory.
10. The method of claim 1 , further comprising detecting one or more families of the domain name, wherein the second DNS requests are associated with the one or more families of the domain name.
11. The method of claim 1 , wherein the determining of the anomaly trend comprises determining that at least one of the count values exceeds a predetermined threshold value.
12. The method of claim 11 , wherein the predetermined threshold value is associated with an average or a median of the count values for the predetermined period.
13. The method of claim 1 , wherein each of the DNS data fragments is in the range from about 1 second to about one week.
14. The method of claim 1 , wherein the anomaly trend is determined using a machine learning classifier.
15. The method of claim 1 , wherein the selection of the particular DNS request is received in an instruction from a user or a machine.
16. The method of claim 1 , wherein the anomaly trend characterizes a malicious activity associated with the first DNS request.
17. The method of claim 1 , further comprising clustering the first DNS query and the plurality of second DNS requests in a database.
18. The method of claim 1 , further comprising marking the first DNS query and the plurality of second DNS requests based on the determination of the anomaly trend.
19. A computer-implemented system for detecting anomalies in Domain Name System (DNS) requests, the system comprising at least one processor and at least one memory storing processor-executable codes, the at least one processor being configured to:
receive DNS data, the DNS data including a plurality of DNS requests generated within a predetermined period, the predetermined period including a plurality of DNS data fragments;
receive a selection of a particular DNS request from the plurality of DNS requests, the particular DNS request being a first DNS request (Qi), the first DNS request being associated with a domain name;
select a plurality of second DNS requests (Qj) from the plurality of DNS requests, each of the second DNS requests being a subset of the first DNS request;
calculate a count value for each of the DNS data fragments, each of the count values representing a number of instances or frequency the second DNS requests appear within one of the DNS data fragments; and
determine an anomaly trend based on the count values of the plurality of second DNS requests associated with the plurality of the DNS data fragments.
20. A non-transitory processor-readable medium having instructions stored thereon, which when executed by one or more processors, cause the one or more processors to implement a method for detecting anomalies in Domain Name System (DNS) requests, the method comprising:
receiving DNS data, the DNS data including a plurality of DNS requests generated within a predetermined period, the predetermined period including a plurality of DNS data fragments;
receiving a selection of a particular DNS request from the plurality of DNS requests, the particular DNS request being a first DNS request (Qi), the first DNS request being associated with a domain name;
selecting a plurality of second DNS requests (Qj) from the plurality of DNS requests, each of the second DNS requests being a subset of the first DNS request;
calculating a count value for each of the DNS data fragments, each of the count values representing a number of instances or frequency the second DNS requests appear within one of the DNS data fragments; and
determining an anomaly trend based on the count values of the plurality of second DNS requests associated with the plurality of the DNS data fragments.