公开(公告)号：US11722504B2

公开(公告)日：2023-08-08

申请号：US17134336

申请日：2020-12-26

申请人： Nozomi Networks Sagl

发明人： Alessandro Di Pinto ,  Moreno Carullo ,  Andrea Carcano ,  Mario Marchese ,  Fabio Patrone ,  Alessandro Fausto ,  Giovanni Battista Gaggero

IPC分类号： H04L61/4511 ,  H04L9/40

CPC分类号： H04L63/1425 ,  H04L61/4511 ,  H04L63/1416 ,  H04L63/1441

摘要： The present invention relates to a method and an apparatus for detecting anomalies of a DNS traffic in a network comprising analysing, through a network analyser connected to said network, each data packets exchanged in the network, isolating, through the network analyser, from each of the analysed data packets the related DNS packet, evaluating, through a computerized data processing unit, each of the DNS packets generating a DNS packet status, signaling, through the computerized data processing unit, an anomaly of the DNS traffic when the DNS packet status defines a critical state, wherein the evaluating further comprises assessing, through the computerized data processing unit, each of the DNS packet by a plurality of evaluating algorithms generating a DNS packet classification for each of the evaluating algorithms, aggregating, through the computerized data processing unit, the DNS packet classifications generating the DNS packet status, and wherein the critical state is identified when the DNS packet status is comprised in a critical state database stored in a storage medium.