Real-time detection of DNS infiltration traffic
Real-time detection of DNS infiltration traffic is disclosed. A DNS response associated with a DNS query sent by a client device is received. An attempted DNS infiltration is detected based at least in part on an automated analysis of the DNS response. In response to the detection, a remedial action is performed.
1 . A system, comprising:
a processor configured to:
receive a DNS response associated with a DNS query sent by a client device;
detect an attempted DNS infiltration of information from a remote server to the client device based at least in part on an automated analysis of the DNS response, including by using a set of infiltration-specific detectors which use infiltration-specific features, including one or more response-specific entropy features, to determine whether the DNS response is likely to encode the information; and
in response to the detection, perform a remedial action; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the DNS response is received, at a server on an external network, from a security appliance collocated with the client device.
3 . The system of claim 1 , wherein the processor is configured to perform the detection using at least one model trained on DNS response feature information.
4 . The system of claim 1 , wherein the processor is configured to perform the detection using a set of heuristics.
5 . The system of claim 1 , wherein performing the remedial action includes including a domain associated with the DNS response in a blocklist.
6 . The system of claim 1 , wherein performing the remedial action includes providing a result of the analysis to a security appliance during a session of the client device.
7 . The system of claim 1 , wherein the remote server is a malicious DNS server and wherein performing the remedial action includes preventing the client device from communicating with the malicious DNS server.
8 . The system of claim 1 , wherein the processor is configured to perform the analysis based at least in part on a feature vector that maintains information for a sliding time window of DNS information.
9 . The system of claim 8 , wherein a feature included in the feature vector represents a number of distinct fully qualified domain names associated with a root domain portion.
10 . The system of claim 1 , wherein the analysis includes determining a correlation between a plurality of IP addresses associated with a domain.
11 . The system of claim 1 , wherein the analysis includes determining a location of a domain.
12 . The system of claim 1 , wherein the analysis includes determining entropy of a set of unique IP addresses.
13 . The system of claim 1 , wherein the analysis includes determining whether the DNS response includes a non-public IPv6 address.
14 . The system of claim 1 , wherein the analysis includes determining whether data in a TXT response matches a pattern.
15 . The system of claim 1 , wherein the analysis includes determining a count of unknown TXT responses.
16 . The system of claim 1 , wherein the analysis includes determining an entropy of a set of unique TXT responses.
17 . The system of claim 1 , wherein the analysis includes determining a meaningful word ratio.
18 . The system of claim 1 , wherein the analysis includes determining a subdomain Jeffrey distribution.
19 . A method, comprising:
receiving a DNS response associated with a DNS query sent by a client device;
detecting an attempted DNS infiltration of information from a remote server to the client device based at least in part on an automated analysis of the DNS response, including by using a set of infiltration-specific detectors which use infiltration-specific features, including one or more response-specific entropy features, to determine whether the DNS response is likely to encode the information; and
in response to the detection, performing a remedial action.
20 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a DNS response associated with a DNS query sent by a client device;
detecting an attempted DNS infiltration of information from a remote server to the client device based at least in part on an automated analysis of the DNS response, including by using a set of infiltration-specific detectors which use infiltration-specific features, including one or more response-specific entropy features, to determine whether the DNS response is likely to encode the information; and
in response to the detection, performing a remedial action.