Detection and mitigation of security threats to a domain name system for a communication network
The disclosure is directed towards the real-time detection and mitigation of security threats to a domain name system (DNS) for a communication network. A graph-theoretic method is applied to detect compromised DNS assets (e.g., DNS servers and web servers that DNS servers map domain names to). A graph is generated from domain name resolution (DNR) transactions. The nodes of the graph represent the DNS assets and edges between the nodes represent the DNR transactions. The graph is analyzed to detect features that signal compromised assets. The detection of such features serves to act as a binary classifier for the represented assets. The binary classifier acts to classify each node as non-compromised or compromised. The analysis is guided by supervised and/or unsupervised machine learning methods. Once the assets are classified, DNR transactions are analyzed in real-time. If the transaction involves a compromised asset, an intervention is performed that mitigates the threat.
1. A computer-implemented method for identifying suspicious communication network assets, the method comprising:
accessing network traffic (NT) data that encodes at least one domain name resolution (DNR) transaction associated with a plurality of addresses that includes a plurality of domain name system (DNS) addresses and at least one target address;
employing the NT data to generate a graph data structure including a plurality of nodes with each node representing an address from the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes with each DNS node representing a DNS address from the plurality of DNS addresses and at least one target node representing the at least one target address, and at least one edge from the plurality of edges connecting each of the plurality of DNS nodes to at least one of the at least one target node based on the at least one DNR transaction;
identifying a first portion of the plurality of nodes, each node included in the first portion of the plurality of nodes is ground-truth labeled as a suspicious node;
identifying a second portion of the plurality of nodes, each node included in the second portion of the plurality of nodes is unclassified; and
assigning a node risk score to each node included in the second portion of the plurality of nodes, based on a comparison of the nodes included in the second portion of the plurality of nodes and each node included in the first portion of the plurality of nodes;
based on the node risk score assigned to each of the plurality of nodes in the second portion, identifying a third portion of the plurality of nodes;
classifying each address of the plurality of addresses that is represented by a node included in the third portion of the plurality of nodes as a suspicious address; and
providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address.
2. The method of claim 1 , wherein the method further comprises:
accessing historical NT data that encodes at least one historical DNR transaction associated with a plurality of historical addresses that includes a plurality of historical DNS addresses and at least one historical target address, each historical DNR transaction of the at least one historical DNR transaction occurred prior to each DNR transaction of the at least one DNR transaction;
employing the historical NT data to generate a historical graph data structure including a plurality of historical nodes with each historical node representing a historical address from the plurality of historical addresses and a plurality of historical edges, the plurality of historical nodes including a plurality of historical DNS nodes with each historical DNS node representing a historical DNS address from the plurality of historical DNS addresses and at least one historical target node representing the at least one historical target address, and at least one historical edge from the plurality of historical edges connecting each of the plurality of historical DNS nodes to at least one of the at least one historical target node based on the at least one historical DNR transaction; and
based on a comparison between the graph data structure and the historical graph data structure, assigning the node risk score to each node of the plurality of nodes.
3. The method of claim 2 , further comprising:
employing a community detection algorithm to detect a plurality of communities for the graph data structure, each community of the plurality of communities includes a unique portion of the plurality of nodes and an intra-community edge density for a particular community of the plurality of communities is greater than an inter-community edge density between the particular community and any other community of the plurality of communities;
based on the comparison between the graph data structure and the historical graph data structure, assigning a community risk score to each community of the plurality of communities; and
based on the community risk score of each community that the node is included in, assigning the node risk score to each of the plurality of nodes.
4. The method of claim 3 , wherein the community risk score assigned to each community of the plurality of communities is determined further based on a fraction of target nodes of the at least one target node that are included in the community and are excluded from the at least one historical target address.
5. The method of claim 3 , wherein the community risk score assigned to each community of the plurality of communities is determined further based on a fraction of DNS nodes of the plurality of DNS nodes that are included in the community and are excluded from the plurality of historical DNS addresses.
6. The method of claim 3 , wherein the community risk score assigned to each community of the plurality of communities is determined further based on a fraction of DNS nodes of the plurality of DNS nodes that are connected to a target node of the at least one target node that is included in the community and is excluded from the plurality of historical DNS addresses.
7. The method of claim 1 , further comprising:
assigning a traffic score, to each node of the plurality of nodes, that is based on a fraction of network traffic associated with an address of the plurality of address that is represented by the node compared to a total network traffic associated with the network traffic data; and
based on the traffic score assigned to the node, determining the node risk score for each node of the plurality of nodes.
8. The method of claim 1 , further comprising:
generating a vector representation for each node included in the first portion of the plurality of nodes;
generating a vector representation for each node included in the second portion of the plurality of nodes; and
assigning the node risk score, to each node included in the first portion of the plurality of nodes, based on a comparison of the vector representation of the nodes included in the first portion of the plurality of nodes and the vector representation of each node included in the second portion of the plurality of nodes.
9. The method of claim 1 , wherein the comparison of the node included in the second portion of the plurality of nodes and each node included in the first portion of the plurality of nodes is based on a belief propagation algorithm.
10. A system comprising:
one or more hardware processors; and
one or more computer-readable media having executable instructions embodied thereon, which, when executed by the one or more processors, cause the one or more hardware processors to execute actions comprising:
accessing network traffic (NT) data that encodes at least one domain name resolution (DNR) transaction associated with a plurality of addresses that includes a plurality of domain name system (DNS) addresses and at least one target address;
employing the NT data to generate a data structure including a plurality of nodes with each node representing an address from the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes with each DNS node representing an address from the plurality of DNS addresses and at least one target node representing the at least one target address, and at least one edge from the plurality of edges connecting each of the plurality of DNS nodes to at least one of the at least one target node based on the at least one DNR transaction;
accessing historical NT data that encodes at least one historical DNR transaction associated with a plurality of historical addresses that includes a plurality of historical DNS addresses and at least one historical target address, each historical DNR transaction of the at least one historical DNR transaction occurred prior to each DNR transaction of the at least one DNR transaction;
employing the historical NT data to generate a historical data structure including a plurality of historical nodes representing the plurality of historical addresses and a plurality of historical edges, the plurality of historical nodes including a plurality of historical DNS nodes representing the plurality of historical DNS addresses and at least one historical target node representing the at least one historical target address, and the plurality of historical edges connecting each of the plurality of historical DNS nodes to at least one of the at least one historical target node based on the at least one historical DNR transaction;
based on a comparison between the data structure and the historical data structure, assigning the node risk score to each node of the plurality of nodes;
based on the node risk score assigned to each of the plurality of nodes, identifying a first portion of the plurality of nodes;
classifying each address of the plurality of addresses that is represented by a node included in the identified first portion of the plurality of nodes as a suspicious address;
providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address.
11. The system of claim 10 , wherein the actions further comprise:
employing a community detection algorithm to detect a plurality of communities for the data structure, each community of the plurality of communities includes a unique portion of the plurality of nodes and an intra-community edge density for a particular community of the plurality of communities is greater than an inter-community edge density between the particular community and any other community of the plurality of communities;
based on the comparison between the data structure and the historical data structure, assigning a community risk score to each community of the plurality of communities; and
based on the community risk score of each community that the node is included in, assigning the node risk score to each of the plurality of nodes.
12. The system of claim 10 , wherein the actions further comprising:
assigning a traffic score, to each node of the plurality of nodes, that is based on a fraction of network traffic associated with an address of the plurality of address that is represented by the node compared to a total network traffic associated with the network traffic data; and
based on the traffic score assigned to the node, determining the node risk score for each node of the plurality of nodes.
13. The system of claim 10 , wherein the actions further comprise:
identifying a second portion of the plurality of nodes, each node included in the second portion of the plurality of nodes is ground-truth labeled as a suspicious node;
identifying third portion of the plurality of nodes, each node included in the third portion of the plurality of nodes is unclassified; and
assigning the node risk score, to each node included in the third portion of the plurality of nodes, based on a comparison of the nodes included in the third portion of the plurality of nodes and each node included in the second portion of the plurality of nodes.
14. The system of claim 13 , wherein the actions further comprise:
generating a vector representation for each node included in the second portion of the plurality of nodes;
generating a vector representation for each node included in the third portion of the plurality of nodes; and
assigning the node risk score to each node included in the second portion of the plurality of nodes based on a comparison of the vector representation of the nodes included in the second portion of the plurality of nodes and the vector representation of each node included in the third portion of the plurality of nodes.
15. The system of claim 13 , wherein the comparison of the node included in the third portion of the plurality of nodes and each node included in the second portion of the plurality of nodes is based on a belief propagation algorithm.
16. One or more non-transitory computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform actions comprising:
accessing network traffic (NT) data that encodes at least one domain name resolution (DNR) transaction associated with a plurality of addresses that includes a plurality of domain name system (DNS) addresses and at least one target address;
employing the NT data to generate a graph data structure including a plurality of nodes representing the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes representing the plurality of DNS addresses and at least one target node representing the at least one target address, and the plurality of edges connecting each of the plurality of DNS nodes to at least one of the at least one target node based on the at least one DNR transaction;
accessing historical NT data that encodes at least one historical DNR transaction associated with a plurality of historical addresses that includes a plurality of historical DNS addresses and at least one historical target address, each historical DNR transaction of the at least one historical DNR transaction occurred prior to each DNR transaction of the at least one DNR transaction;
employing the historical NT data to generate a historical graph data structure including a plurality of historical nodes representing the plurality of historical addresses and a plurality of historical edges, the plurality of historical nodes including a plurality of historical DNS nodes representing the plurality of historical DNS addresses and at least one historical target node representing the at least one historical target address, and the plurality of historical edges connecting each of the plurality of historical DNS nodes to at least one of the at least one historical target node based on the at least one historical DNR transaction;
based on a comparison between the graph data structure and the historical graph data structure, assigning the node risk score to each node of the plurality of nodes;
based on the node risk score assigned to each of the plurality of nodes, identifying a first portion of the plurality of nodes;
classifying each address of the plurality of addresses that is represented by a node included in the identified first portion of the plurality of nodes as a suspicious address;
providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address.
17. The media of claim 16 , wherein the operations further comprise:
identifying a second portion of the plurality of nodes, each node included in the second portion of the plurality of nodes is ground-truth labeled as a suspicious node;
identifying third portion of the plurality of nodes, each node included in the third portion of the plurality of nodes is unclassified; and
assigning the node risk score to each node included in the third portion of the plurality of nodes based on a comparison of the nodes included in the third portion of the plurality of nodes and each node included in the second portion of the plurality of nodes.