Patent Document ID: 10075458
Application ID: 15142389
Patent Flag: 1

Claim One:
1. A method comprising: constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature; computing, using the packet, a metadata item supporting the input feature, wherein the metadata items includes at least one of a count of occurrences of the input feature and a frequency of occurrence of the input feature; classifying, using a processor and a memory to execute a trained cognitive classification model, and by supplying the input feature and the supporting metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server; outputting, from the cognitive classification model, a classification of the packet as malicious, and a confidence value in the malicious classification; causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling; parsing a payload of the record in the packet, wherein the payload is an actual value of a content in a data field of the record inside the packet; selecting a term in the parsed payload; selecting a set of words in the parsed payload, the set of words including the term; passing the term and the set of words to a function to obtain a set of weights corresponding to a set of nodes in a recurrent Neural Network (RNN); generating, by applying the set of weights to the corresponding set of nodes in the RNN, a cognitive output; computing a confidence value corresponding to the cognitive output; using a classification of the cognitive output and the confidence value to classify the DNS communication as malicious; configuring the function such that, when the set of weights is applied to the corresponding set of nodes, for the term, the RNN outputs an entity of the term, a co-reference of the term, and a class of the term; and using the class of the term in the classification.