APPLYING NATURAL LANGUAGE PROCESSING ANOMALY MEASURES AS FEATURES FOR DNS TUNNELING DETECTION
Various techniques for applying natural language processing (NLP) as features for DNS tunneling detection are disclosed. In some embodiments, a system/process/computer program product for applying natural language processing as features for DNS tunneling detection includes aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy.
1 . A system, comprising:
a processor configured to:
aggregate DNS traffic from one or more networks;
automatically classify the aggregated DNS traffic to detect DNS tunneling activity; and
perform an action based on the detected DNS tunneling activity based on a policy; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier.
3 . The system recited in claim 1 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for neural network anomaly detection using an autoencoder.
4 . The system recited in claim 1 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for n-gram anomaly detection using an isolation forest.
5 . The system recited in claim 1 , wherein the aggregated DNS traffic is collected from a plurality of monitored enterprise, university, and/or government networks.
6 . The system recited in claim 1 , wherein a new threat domain is identified based on being associated with the detected DNS tunneling activity.
7 . The system recited in claim 1 , wherein a domain is identified as associated with the detected DNS tunneling activity, and wherein an action is performed based on the policy.
8 . The system recited in claim 1 , wherein the processor is further configured to:
identify a domain as associated with the detected DNS tunneling activity.
9 . The system recited in claim 1 , wherein the processor is further configured to:
block a domain in near real-time at a DNS security platform, wherein the domain is associated with the detected DNS tunneling activity, and wherein the domain is blocked at least for a predetermined period of time.
10 . The system recited in claim 1 , wherein the processor is further configured to:
report a domain, wherein the domain is associated with the detected DNS tunneling activity.
11 . The system recited in claim 1 , wherein the processor is further configured to:
add a domain to a block list, wherein the domain is associated with the detected DNS tunneling activity.
12 . The system recited in claim 1 , wherein the processor is further configured to:
quarantine a domain, wherein the domain is associated with the detected DNS tunneling activity.
13 . The system recited in claim 1 , wherein the processor is further configured to:
automatically generate a new DNS signature for a domain, wherein the domain is associated with the detected DNS tunneling activity.
14 . A method, comprising:
aggregating DNS traffic from one or more networks;
automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and
performing an action based on the detected DNS tunneling activity based on a policy.
15 . The method of claim 14 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier.
16 . The method of claim 14 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for neural network anomaly detection using an autoencoder.
17 . The method of claim 14 , wherein automatically classifying the aggregated DNS traffic to detect the DNS tunneling activity is performed using a classifier that is trained for n-gram anomaly detection using an isolation forest.
18 . The method of claim 14 , wherein the aggregated DNS traffic is collected from a plurality of monitored enterprise, university, and/or government networks.
19 . The method of claim 14 , wherein a new threat domain is identified based on being associated with the detected DNS tunneling activity.
20 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
aggregating DNS traffic from one or more networks;
automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and
performing an action based on the detected DNS tunneling activity based on a policy.