Machine Learning Is Helping to Combat Cyberthreats

CenturyLink’s Black Lotus Labs Shows Importance of DNS Monitoring

Domain Name Server (DNS) tunneling remains a popular method used for cyberattacks because too many organizations allow DNS traffic to go unmonitored. In a new blog, technology leader CenturyLink shares insights from its threat research and operations team, Black Lotus Labs, about the security risk posed by lax attitudes toward monitoring.

Read More: Google Cloud and VMware Extend Strategic Partnership

Among the dangers of DNS tunneling is it can be used to encode data in subdomains of a query or response, allowing unabated network access to extract data, subvert security controls or send arbitrary traffic. On average, Black Lotus Labs monitors 771 million queries globally each day for tunneling activity and other potentially malicious behavior. The team uses machine learning techniques to flag suspicious domains, evaluate them and protect CenturyLink and its customers against them. Left undetected, this covert channel for communication can cause significant impact to businesses.

“CenturyLink operates one of the largest resolution services on the internet. This gives us the unique ability to identify and enumerate malicious infrastructure changes as they propagate,” said Mike Benjamin, head, Black Lotus Labs. “The concern is, not enough is being done to monitor queries so we hope this information helps to bring awareness of the risk to more people.”

Read More: tZERO Crypto App to Add Ravencoin as Third Cryptocurrency

Steps to Subvert This Popular Attack Method:

• Implement protocols to monitor DNS traffic and logs for anomalies that may indicate malicious use of DNS
• Embed security in the network and leverage an agile threat environment that includes the ability to automatically terminate malicious queries
• Evaluate what constitutes a trusted network environment and practice good cyber hygiene

Read More: ANSYS and Edge Case Research Transform Autonomous Vehicle Artificial Intelligence