Abstract: Various techniques for providing a DNS Early Threat Executive Response System (DETERS) are disclosed. In some embodiments, DETERS is a comprehensive DNS threat detection, response, and reporting system with a modular analytics architecture that allows for early detection of suspicious activity in near real-time. DETERS can identify threats before they are able to spread or compromise systems. DETERS uses a combination of streaming and batch processing, as well as historical DNS information. The DNS-centric design allows a DNS resolver to quickly mitigate threats and for the reporting system to alert users allowing them to take further actions that are reflected in the DNS resolver response policy.

Abstract: Various techniques for DNS security operations center insights for mass spreading detection are disclosed. In some embodiments, a system/process/computer program product for DNS security operations center insights for mass spreading detection includes collecting Domain Name System (DNS) security associated events; generating a plurality of insights based on the collected DNS security associated events, wherein at least one of the plurality of insights includes a mass spreading detection insight; and performing an action based on one or more of the insights including the mass spreading detection insight.

Abstract: Various techniques for DNS security operations center insights are disclosed. In some embodiments, a system/process/computer program product for DNS security operations center insights includes collecting Domain Name System (DNS) security associated events; generating a plurality of insights based on the collected DNS security associated events; and performing an action based on one or more of the insights.

Abstract: A server may generate a unique identifier based on a request from an output device to pair a user device with the output device, send a first message comprising the unique identifier to the output device, receive, from the user device, a second message comprising the unique identifier, and generate and send a third message to the output device that enables the output device to pair with the user device such that the user device is enabled to control the output device over a local area network.

Abstract: Various techniques for applying natural language processing (NLP) as features for DNS tunneling detection are disclosed. In some embodiments, a system/process/computer program product for applying natural language processing as features for DNS tunneling detection includes aggregating DNS traffic from one or more networks; automatically classifying the aggregated DNS traffic to detect DNS tunneling activity; and performing an action based on the detected DNS tunneling activity based on a policy.

Abstract: Various techniques for providing a DNS Early Threat Executive Response System (DETERS) are disclosed. In some embodiments, DETERS is a comprehensive DNS threat detection, response, and reporting system with a modular analytics architecture that allows for early detection of suspicious activity in near real-time. DETERS can identify threats before they are able to spread or compromise systems. DETERS uses a combination of streaming and batch processing, as well as historical DNS information. The DNS-centric design allows a DNS resolver to quickly mitigate threats and for the reporting system to alert users allowing them to take further actions that are reflected in the DNS resolver response policy.