COMPUTING APPARATUS AND METHOD FOR IDENTIFYING COMPROMISED APPARATUSES BASED ON DNS TUNNELLING DETECTION Russian patent published in 2022 - IPC G06F21/55 H04L61/4511 

FIELD: information security.

SUBSTANCE: computer-implemented method for identifying compromised apparatuses using DNS tunnelling includes the following stages: receiving the traffic of the protected network infrastructure; retrieving at least one DNS query from the traffic; filtering the list of identified DNS queries while excluding the queries for previously determined types of domain names therefrom; feeding each of the multiple domain names remaining in the list one by one to the input of a pre-trained deciding rule; if at least one domain name has received a negative estimation of the deciding rule, increasing the penalty for the apparatus having output at least one DNS query containing said domain name; if the total penalty of at least one apparatus exceeds the predetermined threshold, data of the device is considered compromised, wherein a notification thereof is displayed.

EFFECT: increase in the accuracy of identifying compromised apparatuses based on DNS tunnelling detection.

13 cl, 3 dwg