Domain generation algorithms (DGA)
Generate thousands of throwaway domains no feed has indexed yet.
The continuous process of monitoring network activity, establishing a baseline of normal behavior, and automatically flagging deviations that signal a threat, misconfiguration, or attack in progress—focused on the DNS and DHCP layers where every attacker leaves a trace.
Signature-based detection catches what's already been cataloged. Threat feeds block what's already been reported. Both are reactive by design—while sophisticated attackers operate in the gap between first seen and first published.
Since DNS and DHCP are the first infrastructure layers every device (and every attacker) interacts with, anomaly detection at the DDI layer gives your security stack the earliest possible warning signal to work with.
Generate thousands of throwaway domains no feed has indexed yet.
Exfiltrates data through query payloads that no rule was written to catch.
Exhausts IP pools silently before any alert fires.
Maps internal infrastructure through a flood of recursive queries.
Acquire leases and pivot laterally before they're ever noticed.
Every one of these techniques exploits the blind spot that exists when detection depends entirely on known-bad signatures.
The engine learns your network's normal behavior, watches every DNS query and DHCP transaction against that baseline in real time, and automatically contains anything that crosses the line.
The engine observes your environment's normal rhythms—DNS query volumes, domain diversity, query type distributions, lease patterns, and client-to-subnet relationships—and builds a living model of what normal looks like.
Every DNS query and DHCP transaction is measured against that baseline the moment it arrives. Spikes, abnormal frequencies, and high-entropy domains are flagged immediately.
Every flagged event is scored from 0 to 100 across four severity levels—Low, Medium, High, and Critical—weighing confidence and potential damage.
When an anomaly crosses your configured severity threshold, the engine takes containment action automatically—no manual intervention required.
Every quarantined entity lands in a unified dashboard with full context. Admins review evidence, validate the call, and release legitimate entities.
Every validated anomaly and confirmed false positive feeds back into the baseline, making each detection cycle sharper than the last.
DNS anomalies are deviations in query behavior that point to malicious activity, protocol abuse, or infrastructure reconnaissance. DNS is queried by every device before it communicates—making it the most comprehensive visibility point in your security stack.
Malware programmatically generates random-looking domain names, querying them rapidly until one resolves to a C2 server. High entropy and volume form a detectable pattern well before feeds catch up.
Attackers encode data inside DNS query payloads—unusually long subdomains or uncommon record types like TXT and NULL—to exfiltrate data or maintain a covert C2 channel.
A rapid burst of subdomain queries used to map internal infrastructure. Detectable through volume spikes against a single parent domain in a compressed timeframe.
Unusual concentrations of specific record types—excessive TXT, ANY, or NULL queries—that deviate from established distributions and indicate protocol abuse or reconnaissance.
Abnormal volumes of response codes—particularly NXDomain—indicating scanning activity, misconfigured clients, or DGA-infected endpoints.
Behavioral deviations specific to Windows environments: abnormal dynamic update activity, unusual WINS lookups, and off-norm query behaviors.
DHCP anomalies are deviations in lease request and allocation behavior that indicate rogue devices, misconfigured clients, or deliberate attacks against IP address infrastructure.
An attacker floods the DHCP server with lease requests using spoofed MAC addresses, exhausting the IP pool and denying legitimate devices access.
Multiple devices claiming the same IP, indicating either a misconfiguration or a deliberate address conflict attack.
A client requesting and releasing leases at abnormally high frequency—a signature of flood tools, faulty stacks, or deliberate churn.
Leases held by devices no longer active—ghost devices, improper decommissioning, or zombie endpoints that represent an unmonitored footprint.
A single MAC acquiring leases across multiple subnets, signalling lateral movement, misconfiguration, or unauthorized network behavior.
The DHCPv6 equivalents: duplicate DUIDs, duplicate IAIDs, and rapid flooding against IPv6 lease infrastructure.
Anomaly detection turns raw network noise into early, actionable signal. Here's what that shift delivers for security and compliance teams.
Rule-based coverage combined with AI/ML behavioral analysis in a single pipeline.
Inline analysis at the moment of query or transaction—not batch log review.
Both protocol layers monitored natively in one platform, not stitched together.
0—100 scoring with configurable quarantine thresholds and severity bands.
Containment mechanisms tuned for Windows and Linux endpoints alike.
Drill-down into domains, clients, and full query trails for investigation.
Validation and release actions so legitimate entities aren't held in quarantine.
Report retention windows tuned to audit and compliance requirements.
DDI Central brings DNS, DHCP, and IP address management together in a single platform—running anomaly detection natively across both protocol layers with automated scoring, quarantine, and investigation built in.
DDI Central's anomaly detection engine runs on two parallel tracks: a comprehensive library of built-in detection rules covering known DNS and DHCP anomaly types, plus Zoho's Zia AI engine applying machine learning to catch behavioral threats—including DGA patterns—that no rule has been written for yet. Every detected anomaly is scored 0 to 100 across Low, Medium, High, and Critical bands.
The Anomaly Insights dashboard surfaces total anomaly volume, severity distribution, trend curves, top flagged domains, top suspicious DNS clients, and top misbehaving DHCP endpoints across every site and cluster. Every panel drills down to full forensic detail with a single click.
When an anomaly crosses the configured severity threshold, the offending entity is quarantined automatically: DNS clients via Client Subnet restriction on Windows or ACL blocking on Linux; flagged domains via DNS Firewall on both; DHCP clients via MAC filtering on Windows or restrictive reservation on Linux.
The Reports module provides time-bound, filterable views of all DNS and DHCP anomaly activity, with chart visualizations, drill-down tables, and granular filters across anomaly category, severity, domain, client IP, subnet, and cluster. Export as PDF or CSV; retention configurable from 30 days to three years.
Deploy ManageEngine DDI Central and see behavioral threats surface before they cause damage.