Patent ID: 11916942
Assignee: INFOBLOX INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system, comprising:
a processor configured to:
receive a set of passive DNS data, wherein the set of passive DNS data includes a DNS query and a DNS response for resolution of the DNS query for each of a plurality of DNS queries;
extract a plurality of features associated with each domain in the set of passive DNS; data, wherein the plurality of features includes a number of unique sub-prefixes for a domain, a total number of queries for the domain, and a time span between an earliest observation and a latest observation of a sub-prefix in the domain; and
classify DNS tunneling activities and perform false positive reduction using the plurality of features associated with each domain in the set of passive DNS data to reduce false positive; detections, wherein the classifying of the DNS tunneling activities and the performing of the false positive reduction comprises to:
classify, using a model, the DNS tunneling activities into a DNS tunnel or a non-tunnel, wherein the model is trained using sets of known tunnel domains and known domains that are not DNS tunnels; and

a memory coupled to the processor and configured to provide the processor with instructions.