Cognitive and contextual detection of malicious DNS

1. A method comprising:

constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature;

computing, using the packet, a metadata item supporting the input feature;

computing a set of weights corresponding to a set of nodes in a recurrent neural network (RNN) by passing a term and a set of words to a function, wherein the term and the set of words are parsed from a payload of the record in the packet;

applying the set of weights to the set of nodes in the RNN to output an entity of the term, a co-reference of the term, and a class of the term;

computing a confidence value corresponding to the entity of the term, the co-reference of the term, or the class of the term;

classifying, using a processor and a memory to execute a cognitive classification model, and by supplying the input feature and the metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server, the classifying using the confidence value and one of the entity of the term, the co-reference of the term, or the class of the term;

outputting, from the cognitive classification model, a classification of the packet as malicious, and the confidence value in the malicious classification; and

causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.

2. The method of claim 1 , further comprising:

extracting a DNS protocol attribute from the packet, wherein the DNS protocol attribute is based on the record, wherein the DNS protocol attribute is a characteristic of a data field inside the packet, the data field being a part of the record, and wherein the characteristic is distinct from an actual value of a content of the data field; and

using the DNS protocol attribute as the input feature.

3. The method of claim 2 , wherein the DNS protocol attribute comprises an encoding used in populating the data field with the content, and wherein the data field is expected to be populated with the content in a form other than the encoding.

4. The method of claim 2 , wherein the DNS protocol attribute comprises a first character set used in populating the data field with the content, and wherein the data field is expected to be populated with the content using a second character set.

5. The method of claim 2 , wherein the DNS protocol attribute comprises an entropy of the content relative to a second content of another packet in the DNS communication over a period.

6. The method of claim 2 , wherein the DNS protocol attribute comprises an numerosity of the record in the packet, wherein the numerosity exceeds a threshold number.

7. The method of claim 2 , wherein the DNS protocol attribute comprises an numerosity of the data field in the record, wherein the numerosity exceeds a threshold number.

8. The method of claim 1 , further comprising:

computing a DNS traffic parameter from the packet, wherein the DNS traffic parameter is a characteristic associated with a DNS communication based on the record, and wherein the characteristic is distinct from an actual value of a content in a data field inside the packet; and

using the DNS traffic parameter as the input feature.

9. The method of claim 8 , wherein the DNS traffic parameter comprises a number of transmission over a period of packets having a type of the packet, wherein the number exceeds a threshold number.

10. The method of claim 8 , wherein the DNS traffic parameter comprises a number of requests over a period of a type of request contained in the packet, wherein the number exceeds a threshold number.

11. The method of claim 8 , wherein the DNS traffic parameter comprises a number of responses over a period of a type of response contained in the packet, wherein the number exceeds a threshold number.

12. The method of claim 8 , wherein the DNS traffic parameter comprises a volume of transmitted data over a period to the DNS server, the transmitted data including the packet, wherein the volume exceeds a threshold volume.

13. The method of claim 8 , wherein the DNS traffic parameter comprises a volume of transmitted data over a period relating to a particular domain, the transmitted data including the packet, wherein the volume exceeds a threshold volume.

14. The method of claim 8 , wherein the DNS traffic parameter comprises a frequency of transmitted data over a period to the DNS server, the transmitted data including the packet, wherein the frequency exceeds a threshold frequency.

15. The method of claim 1 , further comprising:

parsing the payload of the record in the packet, wherein the payload is an actual value of a content in a data field of the record inside the packet;

selecting the term in the parsed payload;

selecting the set of words in the parsed payload, the set of words including the term; and

using a classification of the cognitive output and the confidence value to classify the DNS communication as malicious.

16. The method of claim 1 , further comprising:

using the class of the term in the classification.

17. The method of claim 15 , further comprising:

configuring the function such that, when the set of weights is applied to the corresponding set of nodes, for the term, the RNN outputs a Cartesian distance between malicious co-occurrences of the term in the DNS communication; and

detecting co-occurrences at the Cartesian distance in the payload; and

using the detecting in the classification.

18. The method of claim 1 , further comprising:

constructing a second input feature, wherein the input feature comprises a DNS protocol attribute of the packet, and wherein the second input feature comprises a DNS traffic parameter of the DNS communication including the packet;

constructing a third input feature, wherein the third input feature comprises a term in a payload of the packet;

cross-correlating at least one of the input feature, the second input feature, and the third input feature with information from a third-party data source; and

using the cross-correlated at least one of the input feature, the second input feature, and the third input feature in the classifying.

19. A computer usable program product comprising a computer readable storage device including computer usable code, the computer usable code comprising:

computer usable code for constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature;

computer usable code for computing, using the packet, a metadata item supporting the input feature;

computer usable code computing a set of weights corresponding to a set of nodes in a recurrent neural network (RNN) by passing a term and a set of words to a function, wherein the term and the set of words are parsed from a payload of the record in the packet;

computer usable code applying the set of weights to the set of nodes in the RNN to output an entity of the term, a co-reference of the term, and a class of the term;

computer usable code computing a confidence value corresponding to the entity of the term, the co-reference of the term, or the class of the term;

computer usable code classifying, using a processor and a memory to execute a cognitive classification model, and by supplying the input feature and the metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server, the classifying using the confidence value and one of the entity of the term, the co-reference of the term, or the class of the term;

computer usable code for outputting, from the cognitive classification model, a classification of the packet as malicious, and the confidence value in the malicious classification; and

computer usable code for causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.

20. A data processing system comprising:

a storage device, wherein the storage device stores computer usable program code; and

a processor, wherein the processor executes the computer usable program code, and wherein the computer usable program code comprises:

computer usable code for constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature;

computer usable code for computing, using the packet, a metadata item supporting the input feature;

computer usable code computing a set of weights corresponding to a set of nodes in a recurrent neural network (RNN) by passing a term and a set of words to a function, wherein the term and the set of words are parsed from a payload of the record in the packet;

computer usable code applying the set of weights to the set of nodes in the RNN to output an entity of the term, a co-reference of the term, and a class of the term;

computer usable code computing a confidence value corresponding to the entity of the term, the co-reference of the term, or the class of the term;

computer usable code classifying, using a processor and a memory to execute a cognitive classification model, and by supplying the input feature and the metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server, the classifying using the confidence value and one of the entity of the term, the co-reference of the term, or the class of the term;

computer usable code for outputting, from the cognitive classification model, a classification of the packet as malicious, and the confidence value in the malicious classification; and

computer usable code for causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.