Detect & Block DNS tunnelling and Data exfiltration over DNS | Voters

Detect & Block DNS tunnelling and Data exfiltration over DNS

Josh Lamb

In addition to blocking malicious activity by identifying & categorising DNS domains, include a feature to monitor/log/block DNS tunnelling and data exfiltration activity. For example, use Payload Analysis & Traffic analysis to identify these exploits.

April 4, 2020

Derek Gabriel

Not really seeing this done by anyone in the 'dns filtering' space yet, it would definitely raise the bar. I would think this would be a fun and fairly easy ML project for an internt, when you've got access to so much traffic in aggregate, misuse should stick out like a sore thumb.

Moshe de Freudiger

Would this be strictly for endpoints with the agent installed?

Mitchell

Great Idea, wow, wow. That would be amazing for sure.