Identification and inspection of outlier domain name system requests
The technology disclosed herein enables identification of outlier DNS requests so the identified requests can be inspected to determine whether the identified requests may be associated with suspicious activity. In a particular example, a method provides determining characteristics of a Domain Name System (DNS) request and generating a score for the DNS request from the characteristics. The method further provides grouping a plurality of DNS requests into one or more groups based on a plurality of DNS request scores for the plurality of DNS requests. The plurality of DNS requests occurred in a specified timeframe and include the DNS request. The plurality of DNS request scores includes the score. In response to determining the DNS request is an outlier relative to the one or more groups, the method provides inspecting the DNS request for anomalies.
1. A method comprising:
determining characteristics of a Domain Name System (DNS) request;
generating a score for the DNS request from the characteristics;
grouping a plurality of DNS requests into one or more groups based on a plurality of DNS request scores for the plurality of DNS requests, wherein the plurality of DNS requests occurred in a specified timeframe and include the DNS request, wherein the plurality of DNS request scores includes the score; and
in response to determining the DNS request is an outlier relative to the one or more groups, inspecting the DNS request for anomalies.
2. The method of claim 1 , comprising:
determining a plurality of characteristics of the plurality of DNS requests; and
generating the plurality of DNS request scores from the plurality of characteristics.
3. The method of claim 1 , wherein inspecting the DNS request comprises:
determining a host posture for a system that generated the DNS request.
4. The method of claim 1 , comprising:
receiving the specified timeframe from a user.
5. The method of claim 4 , wherein the specified timeframe corresponds to a time when malicious activity is thought to have originated.
6. The method of claim 1 , wherein the characteristics include one or more from a set comprising:
a nameserver network address to which the DNS request is directed;
a first geographic location of a nameserver having the nameserver network address;
a network address of a system that generated the DNS request;
a domain name indicated by the DNS request;
a destination network address resolved in response to the DNS request; and
a second geographic location of a system having the destination network address.
7. The method of claim 1 , comprising:
receiving the DNS request; and
transmitting the DNS request to a nameserver for resolution.
8. The method of claim 1 , wherein generating the score comprises:
adjusting a value for the score based on values assigned to each of the characteristics.
9. The method of claim 8 , wherein the values correspond to levels of importance of the characteristics relative to each other.
10. An apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the apparatus to:
determine characteristics of a Domain Name System (DNS) request;
generate a score for the DNS request from the characteristics;
group a plurality of DNS requests into one or more groups based on a plurality of DNS request scores for the plurality of DNS requests, wherein the plurality of DNS requests occurred in a specified timeframe and include the DNS request, wherein the plurality of DNS request scores includes the score; and
in response to determining the DNS request is an outlier relative to the one or more groups, inspect the DNS request for anomalies.
11. The apparatus of claim 10 , wherein the program instructions direct the apparatus to:
determine a plurality of characteristics of the plurality of DNS requests; and
generate the plurality of DNS request scores from the plurality of characteristics.
12. The apparatus of claim 10 , wherein to inspect the DNS request, the program instructions direct the apparatus to:
determine a host posture for a system that generated the DNS request.
13. The apparatus of claim 10 , wherein the program instructions direct the apparatus to:
receive the specified timeframe from a user.
14. The apparatus of claim 13 , wherein the specified timeframe corresponds to a time when malicious activity is thought to have originated.
15. The apparatus of claim 10 , wherein the characteristics include one or more from a set comprising:
a nameserver network address to which the DNS request is directed;
a first geographic location of a nameserver having the nameserver network address;
a network address of a system that generated the DNS request;
a domain name indicated by the DNS request;
a destination network address resolved in response to the DNS request; and
a second geographic location of a system having the destination network address.
16. The apparatus of claim 10 , wherein the program instructions direct the apparatus to:
receive the DNS request; and
transmit the DNS request to a nameserver for resolution.
17. The apparatus of claim 10 , wherein to generate the score, the program instructions direct the apparatus to:
adjust a value for the score based on values assigned to each of the characteristics.
18. One or more non-transitory computer readable storage media having program instructions stored thereon, the program instructions, when read and executed by a processing system, direct the processing system to:
determine characteristics of a Domain Name System (DNS) request;
generate a score for the DNS request from the characteristics;
group a plurality of DNS requests into one or more groups based on a plurality of DNS request scores for the plurality of DNS requests, wherein the plurality of DNS requests occurred in a specified timeframe and include the DNS request, wherein the plurality of DNS request scores includes the score; and
in response to determining the DNS request is an outlier relative to the one or more groups, inspect the DNS request for anomalies.