Abstract: Various embodiments of the invention disclosed herein provide techniques for associating a firewall policy with a dynamic domain name system (DNS) hostname. A policy configuration portal transmits a first request to a names server to translate a first hostname into a corresponding network address. The policy configuration portal receives a first network address from the names server in response to the first request. The policy configuration portal determines that the first network address is different than a second network address that is currently associated with the first hostname. The policy configuration portal associates the first network address with the first hostname. The policy configuration portal modifies a firewall policy configuration associated with the first hostname to include the first network address. At least one advantage of the disclosed techniques is that a firewall policy can be implemented for a residential home or small business that employs dynamic IP addressing.

Abstract: Various embodiments of the invention disclosed herein provide techniques for associating a firewall policy with a dynamic domain name system (DNS) hostname. A policy configuration portal associates a first hostname with a first network address. The policy configuration portal sets firewall policy configuration associated with the first hostname to include the first network address. The policy configuration portal receives a first message that associates a DNS hostname with a second network address. The policy configuration portal, in response to receiving the first message, associates the second network address with the first hostname. The policy configuration portal modifies a firewall policy configuration associated with the first hostname to include the second network address. At least one advantage of the disclosed techniques is that a firewall policy can be implemented for a residential home or small business that employs dynamic IP addressing.

Abstract: Various embodiments of the invention disclosed herein provide techniques for managing a domain name system (DNS) based attack. An exfiltration and tunneling mitigation platform receives a first DNS request directed to a first domain name. The exfiltration and tunneling mitigation platform determines that a first characteristic associated with a first fully qualified domain name (FQDN) included in the first DNS request exceeds a first threshold value. In response, the exfiltration and tunneling mitigation platform computes a distance between the first FQDN and a second FQDN included in a second DNS request also directed to the first domain name. The exfiltration and tunneling mitigation platform increments a first count value associated with the first domain name based on the distance. At least one advantage of the disclosed techniques is that a DNS-based attack can be detected and mitigated before a significant amount of DNS exfiltration or DNS tunneling has occurred.

Abstract: Various embodiments of the invention disclosed herein provide techniques for associating a firewall policy with a dynamic domain name system (DNS) hostname. A policy configuration portal associates a first hostname with a first network address. The policy configuration portal sets firewall policy configuration associated with the first hostname to include the first network address. The policy configuration portal receives a first message that associates a DNS hostname with a second network address. The policy configuration portal, in response to receiving the first message, associates the second network address with the first hostname. The policy configuration portal modifies a firewall policy configuration associated with the first hostname to include the second network address. At least one advantage of the disclosed techniques is that a firewall policy can be implemented for a residential home or small business that employs dynamic IP addressing.

Abstract: Various embodiments of the invention disclosed herein provide techniques for managing a domain name system (DNS) based attack. An exfiltration and tunneling mitigation platform receives a first DNS request directed to a first domain name. The exfiltration and tunneling mitigation platform determines that a first characteristic associated with a first fully qualified domain name (FQDN) included in the first DNS request exceeds a first threshold value. In response, the exfiltration and tunneling mitigation platform computes a distance between the first FQDN and a second FQDN included in a second DNS request also directed to the first domain name. The exfiltration and tunneling mitigation platform increments a first count value associated with the first domain name based on the distance. At least one advantage of the disclosed techniques is that a DNS-based attack can be detected and mitigated before a significant amount of DNS exfiltration or DNS tunneling has occurred.

Abstract: Various embodiments of the invention disclosed herein provide techniques for associating a firewall policy with a dynamic domain name system (DNS) hostname. A policy configuration portal transmits a first request to a names server to translate a first hostname into a corresponding network address. The policy configuration portal receives a first network address from the names server in response to the first request. The policy configuration portal determines that the first network address is different than a second network address that is currently associated with the first hostname. The policy configuration portal associates the first network address with the first hostname. The policy configuration portal modifies a firewall policy configuration associated with the first hostname to include the first network address. At least one advantage of the disclosed techniques is that a firewall policy can be implemented for a residential home or small business that employs dynamic IP addressing.