DNS tunneling prevention

• US 10,097,568 B2
• Filed: 08/25/2016
• Issued: 10/09/2018
• Est. Priority Date: 08/25/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Baughman, Aaron K., Marzorati, Mauro, Porpora, Gregory A.
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US15/247,480
• Publication Number:
  US 20180063162A1
• Time in Patent Office: 775 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored

Abstract

Embodiments for domain name service (DNS) tunneling prevention by a processor. A DNS tunneling detection operation is requested to be performed upon receiving a DNS query. A response is generated based on the DNS tunneling detection operation such that the DNS tunneling detection operation indicates in the response that the DNS query for a domain name is associated with DNS tunneling activity.

Claims

1. A method, by a processor, for domain name service (DNS) tunneling prevention, comprising:

requesting a domain name service (DNS) tunneling detection operation upon receiving a DNS query;

generating a response based on the DNS tunneling detection operation such that the DNS tunneling detection operation indicates in the response that the DNS query for a domain name is associated with DNS tunneling activity;

assigning a value to each one of a plurality of factors, wherein the plurality of factors include an age of a domain name, a set of resource records, reputation data of the domain name, and detection of DNS tunneling activity using DNS tunneling;

calculating a DNS response score according to the assigned values for generating the response;

comparing the DNS response score to a first level threshold; and

providing a non-existing domain in the DNS response to prevent the DNS tunneling activity upon the DNS response score being greater than the first level threshold.

2. The method of claim 1, further including providing in the response a request to perform a DNS lookup request to determine the DNS query is associated with the DNS tunneling activity.

3. The method of claim 1, further including sending a non-existing domain name in the response to prevent the DNS tunneling according to the response.

4. The method of claim 1, further including:

comparing the DNS response score to a second level threshold; and

providing a DNS server address in the DNS response upon the DNS response score being less than the second level threshold.

5. A system for domain name service (DNS) tunneling prevention, comprising:

one or more computers with executable instructions that when executed cause the system to;

request a domain name service (DNS) tunneling detection operation upon receiving a DNS query;

generate a response based on the DNS tunneling detection operation such that the DNS tunneling detection operation indicates in the response that the DNS query for a domain name is associated with DNS tunneling activity;

assign a value to each one of a plurality of factors, wherein the plurality of factors include an age of a domain name, a set of resource records, reputation data of the domain name, and detection of DNS tunneling activity using DNS tunneling;

calculate a DNS response score according to the assigned values for generating the response;

compare the DNS response score to a first level threshold; and

provide a non-existing domain in the DNS response to prevent the DNS tunneling activity upon the DNS response score being greater than the first level threshold.

6. The system of claim 5, wherein the executable instructions further provide in the response a request to perform a DNS lookup request to determine the DNS query is associated with the DNS tunneling activity.

7. The system of claim 5, wherein the executable instructions further provide send a non-existing domain name in the response to prevent the DNS tunneling activity according to the response.

8. The system of claim 5, wherein the executable instructions further:

compares the DNS response score to a second level threshold; and

provides a DNS server address in the DNS response upon the DNS response score being less than the second level threshold.

9. A computer program product for, by a processor, domain name service (DNS) tunneling prevention, the computer program product comprising a non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising:

an executable portion that requests a domain name service (DNS) tunneling detection operation upon receiving a DNS query;

an executable portion that generates a response based on the DNS tunneling detection operation such that the DNS tunneling detection operation indicates in the response that the DNS query for a domain name is associated with DNS tunneling activity;

an executable portion that assigns a value to each one of a plurality of factors, wherein the plurality of factors include an age of a domain name, a set of resource records, reputation data of the domain name, and detection of DNS tunneling activity using DNS tunneling;

an executable portion that calculates a DNS response score according to the assigned values for generating the response;

an executable portion that compares the DNS response score to a first level threshold; and

an executable portion that provides a non-existing domain in the DNS response to prevent the DNS tunneling activity upon the DNS response score being greater than the first level threshold.

10. The computer program product of claim 9, further including an executable portion that provides in the response a request to perform a DNS lookup request to determine the DNS query is associated with the DNS tunneling activity.

11. The computer program product of claim 9, further including an executable portion that sends a non-existing domain name in the response to prevent the DNS tunneling activity according to the response.

12. The computer program product of claim 9, further including an executable portion that:

compares the DNS response score to a second level threshold; and

provides a DNS server address in the DNS response upon the DNS response score being less than the second level threshold.