Detection of DNS (domain name system) tunneling and exfiltration through DNS query analysis
In one embodiment, a method includes collecting DNS (Domain Name System) communications, analyzing the DNS communications, and identifying DNS tunneling or exfiltration based analysis of the DNS communications. Analyzing the DNS communications includes identifying a distinct query count for each of a plurality of clients over a specified time period and a data transfer direction between the clients and one or more servers, and categorizing the DNS communications based on session features associated with at least one of query type, transfer capability, and server response. An apparatus and logic are also disclosed herein.
1. A method comprising:
collecting and storing DNS (Domain Name System) communications comprising query and response information;
analyzing said stored DNS communications; and
identifying DNS tunneling or exfiltration based on analysis of said DNS communications;
wherein analyzing said DNS communications comprises:
identifying a distinct query count associated with a registered level-domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers; and
categorizing said DNS communications based on session features associated with query type, wherein said categorization is based on transfer capability, server response, and query type diversity.
2. The method of claim 1 wherein said DNS communications comprise queries and analyzing said DNS communications further comprises analyzing lexical features of said queries.
3. The method of claim 1 wherein categorizing said DNS communications comprises categorizing usage based on client count.
4. The method of claim 1 further comprising prefiltering said DNS communications before analyzing said DNS communications.
5. The method of claim 1 further comprising actively probing a suspected authoritative name server.
6. The method of claim 1 wherein analyzing said DNS communications comprises analyzing a payload of a response.
7. The method of claim 1 wherein dynamic DNS domains are identified as public suffixes.
8. An apparatus comprising:
a DNS (Domain Name System) communications collector for collecting query and response information;
memory for storing said DNS communications; and
a DNS communications analyzer for identifying DNS tunneling or exfiltration based on analysis of said stored DNS communications;
wherein the DNS communications analyzer is configured for identifying a distinct query count associated with a registered level-domain for each of a plurality of clients over a specified time period and a data transfer direction between said plurality of clients and one or more servers, and categorizing said DNS communications based on session features associated with query type, wherein said categorization is based on transfer capability, server response, and query type diversity.
9. The apparatus of claim 8 wherein said DNS communications comprise queries and analyzing said DNS communications further comprises analyzing lexical features of said queries.
10. The apparatus of claim 8 wherein categorizing said DNS communications comprises categorizing usage based on client count.
11. The apparatus of claim 8 wherein dynamic DNS domains are identified as public suffixes.
12. The method of claim 1 further comprising categorizing the transfer capability by the server response.
13. The method of claim 1 further comprising breaking down features into said session features, lexical features, and active profiling.
14. The method of claim 2 wherein said lexical features describe characters within the query and are used to identify client-to-attacker traffic and attacker-to-client traffic.
15. The method of claim 2 wherein signature-based encoding detection is used to identify said lexical features.
16. The method of claim 1 further comprising using said query type and said server response to categorize bidirectional and attacker-to-client unidirectional transfers, using lexical analysis to detect data fields, and using active probing to identify client-to-attacker unidirectional transfers.