Managing traffic rules in association with fully qualified domain names (FQDNs)
Systems, methods, and software described herein manage traffic rules in association with fully qualified domain names (FQDNs). In one implementation, a domain name system (DNS) security service obtains notifications associated with an FQDN included in DNS requests. In response to the notifications, the DNS security service generates scores for the FQDN based on trust factors associated with the FQDN and determines traffic rules based on the scores.
1. A method comprising:
obtaining a fully qualified domain name (FQDN) associated with a domain name system (DNS) request by a computing device;
in response to obtaining the FQDN, generating a first score for the FQDN based on trust factors associated with the FQDN, wherein generating the first score comprises determining factor scores for respective ones of the trust factors, combining the factor scores to create the first score, updating the first score upon receiving subsequent DNS requests for the FQDN, and resetting the first score when a timeout time is satisfied;
determining the first score satisfies a first action threshold of a plurality of action thresholds corresponding to different rules of a plurality of traffic rules for a firewall;
determining the first action threshold corresponds to a traffic rule of the plurality of traffic rules; and
implementing the traffic rule for the FQDN in the firewall.
2. The method of claim 1 further comprising:
obtaining one or more notifications of one or more additional DNS requests for the FQDN;
updating the first score to a second score based on the trust factors associated with the FQDN; and
determining a second traffic rule from the plurality of traffic rules for a most recent DNS request of the one or more additional DNS requests based on the second score.
3. The method of claim 1 , wherein the trust factors comprise at least a time delta between requests for the FQDN and a volume of queries for a period.
4. The method of claim 1 , wherein the trust factors comprise popularity information for the FQDN globally.
5. The method of claim 1 , wherein the trust factors comprise scores associated with infrastructure to which A or AAAA records for the FQDN point, a risk score of an authoritative Name Server for the FQDN, or a quantity of record changes for the FQDN.
6. The method of claim 1 , wherein the plurality of traffic rules comprises a rule to allow traffic, a rule to redirect traffic, and a rule to block traffic.
7. The method of claim 1 further comprising communicating the traffic rule to a firewall associated with the computing device.
8. The method of claim 1 further comprising:
obtaining information associated with one or more of the trust factors from an external database.
9. A computing apparatus comprising:
a storage system;
a processing system operatively coupled to the storage system; and
program instructions stored on the storage system that, when executed by the processing system, direct the computing apparatus to:
obtain a fully qualified domain name (FQDN) associated with a domain name system (DNS) request by a computing device;
in response to obtaining the FQDN, generate a first score for the FQDN based on trust factors associated with the FQDN, wherein generation of the first score comprises determining factor scores for respective ones of the trust factors, combining the factor scores to create the first score, updating the first score upon receiving subsequent DNS requests for the FQDN, and resetting the first score when a timeout time is satisfied;
determine the first score satisfies a first action threshold of a plurality of action thresholds corresponding to different rules of a plurality of traffic rules for a firewall;
determine the first action threshold corresponds to a traffic rule of the plurality of traffic rules; and
implement the traffic rule for the FQDN in the firewall.
10. The computing apparatus of claim 9 , wherein the program instructions further direct the computing apparatus to:
obtain one or more notifications of one or more additional DNS requests for the FQDN;
update the first score to a second score based on the trust factors associated with the FQDN; and
determine a second traffic rule from the plurality of traffic rules for a most recent DNS request of the one or more additional DNS requests based on the second score.
11. The computing apparatus of claim 9 , wherein the trust factors comprise at least a time delta between requests for the FQDN and a volume of queries for a period.
12. The computing apparatus of claim 9 , wherein the trust factors comprise popularity information for the FQDN globally.
13. The computing apparatus of claim 9 , wherein the trust factors comprise scores associated with infrastructure to which A or AAAA records for the FQDN point, a risk score of an authoritative Name Server for the FQDN, or a quantity of record changes for the FQDN.
14. The computing apparatus of claim 9 , wherein the plurality of traffic rules comprises a rule to allow traffic, a rule to redirect traffic, and a rule to block traffic.
15. The computing apparatus of claim 9 , wherein the program instructions further direct the computing apparatus to communicate the traffic rule to a firewall associated with the computing device.
16. The computing apparatus of claim 9 , wherein the program instructions further direct the computing apparatus to obtain information associated with one or more trust factors from an external database.
17. A system comprising:
a firewall computing system configured to:
receive a fully qualified domain name (FQDN) as part of a domain name system (DNS) request by a computing device; and
communicate the FQDN to a DNS security service computing system; and
the DNS security service computing system configured to:
receive the FQDN;
in response to receiving the FQDN, generate a first score for the FQDN based on trust factors associated with the FQDN, wherein generation of the first score comprises determining factor scores for respective ones of the trust factors, combining the factor scores to create the first score, updating the first score upon receiving subsequent DNS requests for the FQDN, and resetting the first score when a timeout time is satisfied;
determine the first score satisfies a first action threshold of a plurality of action thresholds corresponding to different rules of a plurality of traffic rules for a firewall;
determine the first action threshold corresponds to a traffic rule of the plurality of traffic rules; and
implement the traffic rule for the FQDN in the firewall.
18. The system of claim 17 , wherein the DNS security service computing system is further configured to:
receive one or more notifications of one or more additional DNS requests for the FQDN;
update the first score to a second score based on the trust factors associated with the FQDN; and
determine a second traffic rule from the plurality of traffic rules for a most recent DNS request of the one or more additional DNS requests based on the second score.