Inline detect and block relayed DNS tunneling traffic
The present application discloses a method, system, and computer system for detecting DNS tunneling traffic. The method includes (i) obtaining non-DNS network traffic across an enterprise network, (ii) obtaining a hostname comprised in the non-DNS network traffic, (iii) querying a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname, (iv) determining whether the non-DNS network traffic is malicious traffic based at least in part on the DNS tunneling attack verdict, and (v) handling the non-DNS network traffic based at least in part on a determination of whether the non-DNS network traffic is malicious traffic based at least in part on the DNS tunneling attack verdict.
1 . A system, comprising:
one or more processors configured to:
obtain web traffic across an enterprise network;
obtain a hostname comprised in the web traffic;
query a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname;
determine whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict; and
handle the web traffic based at least in part on a determination of whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict; and
a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.
2 . The system of claim 1 , wherein obtaining the web traffic across the enterprise network based on detecting the web traffic based at least in part on an application identifier associated with the web traffic.
3 . The system of claim 2 , wherein the one or more processors are further configured to:
determine, based at least in part on the application identifier, whether the web traffic is HTTP traffic, HTTPS traffic, or SMTP traffic.
4 . The system of claim 1 , wherein the web traffic is obtained by a firewall comprised in the enterprise network.
5 . The system of claim 1 , wherein the web traffic comprises a request and response communicated to/from the enterprise network.
6 . The system of claim 1 , wherein obtaining the web traffic comprises:
receiving the web traffic; and
decrypting the web traffic based at least in part on an SSL decryption.
7 . The system of claim 1 , wherein obtaining the web traffic comprises:
receiving the web traffic;
determining that the web traffic is encrypted using a non-standard encryption technique; and
in response to determining that the web traffic is encrypted using the non-standard encryption technique, deeming the web traffic as malicious or suspicious traffic.
8 . The system of claim 7 , wherein the non-standard encryption technique is a non-SSL encryption technique.
9 . The system of claim 1 , wherein obtaining the hostname comprised in the web traffic comprises:
extracting the hostname from metadata associated with the web traffic.
10 . The system of claim 1 , wherein the security service comprises a DNS cloud service.
11 . The system of claim 1 , wherein handling the web traffic based at least in part on the determination of whether the web traffic malicious comprises:
blocking the web traffic in response to determining that the web traffic is malicious.
12 . The system of claim 1 , wherein the security service returns the DNS tunneling verdict in response in response to processing the query based at least in part on the hostname.
13 . The system of claim 1 , wherein the DNS tunneling attack verdict is generated in near real time with interception of the web traffic by a firewall.
14 . The system of claim 1 , wherein the one or more processors are further configured to:
provide a notification to an administrator for the enterprise network in response to determining that the web traffic is malicious.
15 . The system of claim 14 , wherein the notification indicates one or more hosts compromised with an exploit associated with the web traffic.
16 . The system of claim 1 , wherein:
obtaining the hostname comprised in the web traffic comprises:
extracting header information from HTTP or HTTP web traffic; and
the header information comprises the hostname.
17 . The system of claim 1 , wherein:
obtaining the hostname comprised in the web traffic comprises:
extracting header information from SMTP web traffic; and
the header information comprises the hostname.
18 . The system of claim 1 , wherein:
obtaining the hostname comprised in the web traffic comprises:
extracting information from an Server Name Indication (SNI) field from TLS web traffic; and
the information extracted from the SNI field comprises the hostname.
19 . The system of claim 1 , wherein the DNS tunneling attack verdict indicates whether the hostname corresponds to a relayed DNS tunneling attack.
20 . The system of claim 1 , wherein the security service comprises a DNS cloud service that includes a DNS tunneling detector configured to generate the DNS tunneling attack verdict based at least in part on the hostname.
21 . The system of claim 1 , wherein the one or more processors are further configured to:
determine that the web traffic corresponds to a relayed DNS tunneling attack that abuses a reputable web service or an internal web service as a proxy to route DNS tunneling requests toward an attacker-controlled nameserver.
22 . A method, comprising:
obtaining web traffic across an enterprise network;
obtaining a hostname comprised in the web traffic;
querying a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname;
determining whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict; and
handling the web traffic based at least in part on a determination of whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict.
23 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
obtaining web traffic across an enterprise network;
obtaining a hostname comprised in the web traffic;
querying a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname;
determining whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict; and
handling the web traffic based at least in part on a determination of whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict.