Query prints (Qprints): telemetry-based similarity for DNS
Techniques for Qprints using telemetry-based similarity for DNS are provided. In some embodiments, a system/process/computer program product for Qprints using telemetry-based similarity for DNS in accordance with some embodiments includes aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data; clustering the DNS related query data; and generating similarity clusters for domains based on their DNS related query data. For example, the set of network related event data can include passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.
1. A system, comprising:
a processor configured to:
aggregate a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data;
cluster the DNS related query data, comprising to:
create a bag-of-words model for a given domain based on a set of all queries for the given domain associated with the set of network related event data during a particular set of time, wherein a word of the bag-of-words model relates to a combination of a response code (rcode) and a query type, wherein the rcode corresponds to a result of a DNS request; and
group domains having similar behavior; and
generate similarity clusters for domains based on their DNS related query data, comprising to:
identify domains that are similar to the given seed domain based on a feature distribution, wherein domains that are similar to the given seed domain are identified using term frequency-inverse document frequency (TF-IDF); and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data.
3. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time.
4. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express passive DNS (pDNS) data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.
5. The system recited in claim 1 , wherein the set of network related event data includes DNS related query data associated with a first enterprise network and DNS related query data associated with a second enterprise network.
6. The system recited in claim 1 , wherein the processor is further configured to:
compare DNS activities within a first enterprise network based on a baseline of DNS activity associated with the first enterprise network.
7. The system recited in claim 1 , wherein the processor is further configured to:
detect anomalous network activity within a first enterprise network based on a baseline of DNS activity associated with the first enterprise network.
8. The system recited in claim 1 , wherein the processor is further configured to:
compare DNS activities between a first enterprise network and other enterprise networks.
9. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
perform a similar domain search using the pDNS data aggregated over the period of time.
10. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
perform a network summarization using the pDNS data aggregated over the period of time.
11. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
perform a domain characterization using the pDNS data aggregated over the period of time.
12. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
detect a domain change and/or anomaly using the pDNS data aggregated over the period of time.
13. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
identify a network misconfiguration using the pDNS data aggregated over the period of time.
14. The system recited in claim 1 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and quantify similarity of the pDNS data aggregated over the period of time, within and across networks based on telemetry-based similarity for DNS, and wherein the processor is further configured to:
perform an application and service discovery using the pDNS data aggregated over the period of time.
15. A method, comprising:
aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data;
clustering the DNS related query data, comprising:
creating a bag-of-words model for a given domain based on a set of all queries for the given domain associated with the set of network related event data during a particular set of time, wherein a word of the bag-of-words model relates to a combination of a response code (rcode) and a query type, wherein the rcode corresponds to a result of a DNS request; and
grouping domains having similar behavior; and
generating similarity clusters for domains based on their DNS related query data, comprising:
identifying domains that are similar to the given seed domain based on a feature distribution, wherein domains that are similar to the given seed domain are identified using term frequency-inverse document frequency (TF-IDF).
16. The method of claim 15 , wherein the set of network related event data includes passive DNS (pDNS) data.
17. The method of claim 15 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time.
18. The method of claim 15 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express passive DNS (pDNS) data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.
19. A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data;
clustering the DNS related query data, comprising:
creating a bag-of-words model for a given domain based on a set of all queries for the given domain associated with the set of network related event data during a particular set of time, wherein a word of the bag-of-words model relates to a combination of a response code (rcode) and a query type, wherein the rcode corresponds to a result of a DNS request; and
grouping domains having similar behavior; and
generating similarity clusters for domains based on their DNS related query data, comprising:
identifying domains that are similar to the given seed domain based on a feature distribution, wherein domains that are similar to the given seed domain are identified using term frequency-inverse document frequency (TF-IDF).
20. The computer program product recited in claim 19 , wherein the set of network related event data includes passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.