Smart whitelisting for DNS security

1. A system comprising:

a processor configured to:

receive a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data, comprises to:

determine a total number of events of the set of network related event data per second-level domain (SLD); and

remove invalid top-level domains (TLDs) and invalid pointer PTR) records from the total number of events per SLD to obtain the DNS related event data;

receive a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, and wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware;

generate a whitelist using the set of network related event data and the set of network related threat data for policy enforcement based on a configured security policy for an enterprise network, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, wherein the generating of the whitelist comprises to:

determine the top N domains based on the set of network related event data; and

filter, using a threshold, the top N domains to obtain the whitelist, wherein the threshold relates to a number of top domains or popularity over a period of time, wherein the threshold is static or dynamically derived via a machine learning technique, wherein the threshold is updated based on input from a Bayesian conditional probability model, wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware, and wherein the filtering of the top N domains comprises to:

determine a rank of active threats in the top N domains; and

output domains in the top N domains having an active threat to the whitelist;

output the whitelist to a network device for filtering DNS requests using the whitelist; and

identify a network domain for further evaluation to determine whether the network domain is properly included on a blacklist; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the DNS related event data includes a set of popular network domains.

3. The system recited in claim 1 , wherein the DNS related threat data includes a DNS threat feed.

4. The system recited in claim 1 , wherein the DNS related threat data includes a DNS threat feed that is associated with a first enterprise network.

5. The system recited in claim 1 , wherein the subset of network domains included in the whitelist are selected using a classifier.

6. The system recited in claim 1 , wherein the subset of network domains included in the whitelist are selected using a statistical classifier.

7. The system recited in claim 1 , wherein the processor is further configured to:

periodically update the whitelist based on another set of network related event data and another set of network related threat data, wherein the whitelist is automatically and dynamically adjusted to changes in a production data environment associated with a first enterprise network.

8. A method, comprising:

receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event; data, comprises:

determining a total number of events of the set of network related event data per second-level domain (SLD); and

removing invalid top-level domains (TLDs) and invalid pointer (PTR) records from the total number of events per SLD to obtain the DNS related event data;

receiving a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, and wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware;

generating a whitelist using the set of network related event data and the set of network related threat data for policy enforcement based on a configured security policy for an enterprise network, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, wherein the generating of the whitelist comprises:

determining the top N domains based on the set of network related event data; and

filtering, using a threshold, the top N domains to obtain the whitelist, wherein the threshold relates to a number of top domains or popularity over a period of time, wherein the threshold is static or dynamically derived via a machine learning technique, wherein the threshold is updated based on input from a Bayesian conditional probability model, and wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware, and wherein the filtering of the top N domains comprises:

determining a rank of active threats in the top N domains; and

outputting domains in the top N domains having an active threat to the whitelist;

outputting the whitelist to a network device for filtering DNS requests using the whitelist; and

identifying a network domain for further evaluation to determine whether the network domain is properly included on a blacklist.

9. The method of claim 8 , wherein the DNS related event data includes a set of popular network domains.

10. The method of claim 8 , wherein the DNS related threat data includes a DNS threat feed.

11. The method of claim 8 , wherein the DNS related threat data includes a DNS threat feed that is associated with a first enterprise network.

12. The method of claim 8 , wherein the subset of network domains included in the whitelist are selected using a classifier.

13. The method of claim 8 , wherein the subset of network domains included in the whitelist are selected using a statistical classifier.

14. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data; data, comprises:

determining a total number of events of the set of network related event data per second-level domain (SLD); and

removing invalid top-level domains (TLDs) and invalid pointer (PTR) records from the total number of events per SLD to obtain the DNS related event data;

receiving a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, and wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware;

generating a whitelist using the set of network related event data and the set of network related threat data for policy enforcement based on a configured security policy for an enterprise network, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, wherein the generating of the whitelist comprises:

determining the top N domains based on the set of network related event data; and

filtering, using a threshold, the top N domains to obtain the whitelist, wherein the threshold relates to a number of top domains or popularity over a period of time, wherein the threshold is static or dynamically derived via a machine learning technique, wherein the threshold is updated based on input from a Bayesian conditional probability model, and wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware, and wherein the filtering of the top N domains comprises:

determining a rank of active threats in the top N domains; and

outputting domains in the top N domains having an active threat to the whitelist;

outputting the whitelist to a network device for filtering DNS requests using the whitelist; and

identifying a network domain for further evaluation to determine whether the network domain is properly included on a blacklist.

15. The computer program product recited in claim 14 , wherein the DNS related event data includes a set of popular network domains.

16. The computer program product recited in claim 14 , wherein the DNS related threat data includes a DNS threat feed.

17. The computer program product recited in claim 14 , wherein the DNS related threat data includes a DNS threat feed that is associated with a first enterprise network.

18. The computer program product recited in claim 14 , wherein the subset of network domains included in the whitelist are selected using a classifier.