DNS Query Prints for Telemetry-Based Similarity Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in comprehending and analyzing the sheer volume of DNS activity, particularly in large-scale environments with complex configurations and misconfigurations, limiting the ability to identify threats and understand domain similarities.
Innovation Solution
Query Prints (Qprints) utilize telemetry-based similarity for DNS, aggregating and clustering DNS query data to quantify similarity within and across networks, employing statistical and language models to represent domains and infer new insights from partial information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If DNS query data is aggregated and clustered using telemetry-based similarity, then domain similarity identification and threat detection capability is improved, but computational complexity and data processing requirements increase
Solution Approach 1:
The patent segments DNS query data into distinct query print profiles representing different domain categories (e.g., streaming, social media, e-commerce). Each query print captures specific telemetry metrics for its category, breaking down the complex analysis into manageable segments that can be processed independently and then compared for similarity detection.
Solution Approach 2:
The patent introduces query prints as intermediary representations that mediate between raw DNS query data and similarity analysis. These query prints serve as compressed, categorized summaries that enable efficient comparison without requiring direct processing of all raw query details, thus reducing computational complexity while maintaining measurement precision.
2Loss of information
If telemetry-based similarity analysis is applied to DNS data, then actionable intelligence and network security understanding is improved, but data processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary categorization of DNS queries into query prints representing different domain categories before analysis. This preliminary action organizes data in advance, enabling faster retrieval and comparison during security analysis, thus reducing decision-making time while preserving intelligence about DNS activity patterns.
Solution Approach 2:
The patent creates simplified copies of DNS query data in the form of query print profiles that capture essential characteristics without storing all raw query details. These copies enable rapid similarity comparison and intelligence generation while significantly reducing the time required to process and analyze DNS activity data.
Data Source
AI summary
Techniques for Qprints using telemetry-based similarity for DNS are provided. In some embodiments, a system/process/computer program product for Qprints using telemetry-based similarity for DNS in accordance with some embodiments includes aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data; clustering the DNS related query data; and generating similarity clusters for domains based on their DNS related query data. For example, the set of network related event data can include passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.