dns-ml-integration

DNS Machine Learning Integration\n\n\n\n\n\n\n\nThis repository contains the plugin for connecting the CoreDNS server to a Machine Learning Environment for DNS request and response analysis, monitoring and alerting. This can be adapted to work for any other platform as well as language which lacks machine learning capabilities.\n\n## Installation\n\nClone the repository:\n\n\ngit clone https://github.com/nodeshake/dns-ml-integration.git\n\n\nInstall Elasticsearch by following the instructions from this link. Start the Elasticsearch server.\n\nTo install and start CoreDNS please take a look at the CoreDNS repository. Add the mlbridge plugin to CoreDNS. To add external plugins, please take a look at the example plugin.\n\nTo add the plugin to a particular port say 1053, please make the changes to the Corefile as shown below:\n\n\n.:1053 {\n mlplugin\n}\n\n\n## MLBridge Plugin\n\nThe mlbridge plugin is a CoreDNS plugin that forwards requests to the mlbridge-middleware app via HTTP POST requests. Once the mlbridge-middleware app processes the request,it sends the prediction, whether the domain name is malicious or benign, back to the plugin. Depending on the nature of the domain name, the plugin can be configured to allow the request to fall through to the other plugins or send the request to a honeypot or a blackhole.