DNS early threat response
Various techniques for providing a DNS Early Threat Executive Response System (DETERS) are disclosed. In some embodiments, DETERS is a comprehensive DNS threat detection, response, and reporting system with a modular analytics architecture that allows for early detection of suspicious activity in near real-time. DETERS can identify threats before they are able to spread or compromise systems. DETERS uses a combination of streaming and batch processing, as well as historical DNS information. The DNS-centric design allows a DNS resolver to quickly mitigate threats and for the reporting system to alert users allowing them to take further actions that are reflected in the DNS resolver response policy.
1 . A system, comprising:
a processor configured to:
monitor Domain Name System (DNS) network activity at a central DNS resolver;
filter the DNS network activity at a primary detector to forward a subset of domains that were not previously analyzed or were recently registered for further security analysis;
identify a suspicious domain from the subset of domains at a secondary detector in near real-time, comprising to:
filter, based on a reputation score, the subset of domains to obtain a set of filtered domains, wherein the reputation score includes one or more of the following: an associated name server reputation score, and/or a top-level domain (TLD) reputation score; and
confirm, based on a secure sockets layer (SSL) certificate information, a filtered domain of the set of filtered domains to obtain the suspicious domain; and
perform an action in response to the identified suspicious domain; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein the primary detector is configured to filter the DNS network activity based on a historical profile of previously queried domains.
3 . The system recited in claim 1 , wherein the primary detector is configured to filter the DNS network activity based on client IP address historical records including one or more of the following: (1) time of day to detect a device anomaly, and (2) a compromised device and/or geolocation information.
4 . The system recited in claim 1 , wherein the secondary detector is configured to score each of the subset of domains based on one or more of the following: hosted in a bad top level domain (TLD), hosted with a bad name server based on reputation, a known bad Autonomous System Name (ASN), associated with a domain generation algorithm (DGA) structure, and associated with a domain lookalike structure.
5 . The system recited in claim 1 , wherein the DNS network activity is filtered based on a network for a plurality of monitored enterprise, university, and/or government networks.
6 . The system recited in claim 1 , wherein a cloud resolver forwards the DNS network activity to a cloud-based DNS security.
7 . The system recited in claim 1 , wherein the processor is further configured to:
perform additional security analysis on the suspicious domain using a confirmation queue to validate that the suspicious domain is malicious and to promote the suspicious domain to a longer term block or to determine that the domain is not suspicious and to not block the now validated as legitimate domain.
8 . The system recited in claim 1 , wherein the processor is further configured to perform the following action in response to identification of the suspicious domain:
block the suspicious domain in near real-time at a DNS security platform, wherein the suspicious domain is blocked at least for a predetermined period of time.
9 . The system recited in claim 1 , wherein the processor is further configured to perform the following action in response to confirmation that the suspicious domain is malicious:
block a spear phishing attack at a DNS security platform.
10 . The system recited in claim 1 , wherein the processor is further configured to:
report the suspicious domain for a first network based on a DNS security policy associated with the first network.
11 . A method, comprising:
monitoring Domain Name System (DNS) network activity at a central DNS resolver;
filtering the DNS network activity at a primary detector to forward a subset of domains that were not previously analyzed or were recently registered for further security analysis;
identifying a suspicious domain from the subset of domains at a secondary detector in near real-time, comprising:
filtering, based on a reputation score, the subset of domains to obtain a set of filtered domains, wherein the reputation score includes one or more of the following: an associated name server reputation score, and/or a top-level domain (TLD) reputation score; and
confirming, based on a secure sockets layer (SSL) certificate information, a filtered domain of the set of filtered domains to obtain the suspicious domain; and
performing an action in response to the identified suspicious domain.
12 . The method of claim 11 , wherein the primary detector is configured to filter the DNS network activity based on a historical profile of previously queried domains.
13 . The method of claim 11 , wherein the primary detector is configured to filter the DNS network activity based on client IP address historical records including one or more of the following: (1) time of day to detect a device anomaly, and (2) a compromised device and/or geolocation information.
14 . The method of claim 11 , wherein the secondary detector is configured to score each of the subset of domains based on one or more of the following: hosted in a bad top level domain (TLD), hosted with a bad name server based on reputation, a known bad Autonomous System Name (ASN), associated with a domain generation algorithm (DGA) structure, and associated with a domain lookalike structure.
15 . The method of claim 11 , wherein the DNS network activity is filtered based on a network for a plurality of monitored enterprise, university, and/or government networks.
16 . The method of claim 11 , wherein a cloud resolver forwards the DNS network activity to a cloud-based DNS security.
17 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
monitoring Domain Name System (DNS) network activity at a central DNS resolver;
filtering the DNS network activity at a primary detector to forward a subset of domains that were not previously analyzed or were recently registered for further security analysis;
identifying a suspicious domain from the subset of domains at a secondary detector in near real-time, comprising:
filtering, based on a reputation score, the subset of domains to obtain a set of filtered domains, wherein the reputation score includes one or more of the following: an associated name server reputation score, and/or a top-level domain (TLD) reputation score; and
confirming, based on a secure sockets layer (SSL) certificate information, a filtered domain of the set of filtered domains to obtain the suspicious domain; and
performing an action in response to the identified suspicious domain.
18 . The computer program product of claim 17 , wherein the primary detector is configured to filter the DNS network activity based on a historical profile of previously queried domains.
19 . The computer program product of claim 17 , wherein the primary detector is configured to filter the DNS network activity based on client IP address historical records including one or more of the following: (1) time of day to detect a device anomaly, and (2) a compromised device and/or geolocation information.
20 . The computer program product of claim 17 , wherein the secondary detector is configured to score each of the subset of domains based on one or more of the following: hosted in a bad top level domain (TLD), hosted with a bad name server based on reputation, a known bad Autonomous System Name (ASN), associated with a domain generation algorithm (DGA) structure, and associated with a domain lookalike structure.