Patent ID: 11916942
Assignee: INFOBLOX INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 12:
13. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a set of passive DNS data, wherein the set of passive DNS data includes a DNS query and a DNS response for resolution of the DNS query for each of a plurality of DNS queries;
extracting a plurality of features associated with each domain in the set of passive DNS data, wherein the plurality of features includes a number of unique sub-prefixes for a domain, a total number of queries for the domain, and a time span between an earliest observation and a latest observation of a sub-prefix in the domain; and
classifying DNS tunneling activities and performing false positive reduction using the plurality of features associated with each domain in the set of passive DNS data to reduce false positive detections, wherein the classifying of the DNS tunneling activities and the performing of the false positive reduction comprises:
classifying, using a model, the DNS tunneling activities into a DNS tunnel or a non-tunnel, wherein the model is trained using sets of known tunnel domains and known domains that are not DNS tunnels.