Anomaly detections using Docker plugins

Prev Next

Network Detection and Response uses specialized detection using Docker plugins that expand the detection capabilities of the ML engines. It allows the Trellix security research team to package advanced detection logic and bundle them into portable containers, enabling faster response to emerging threats. These plugins receive metadata, events, and flow records from connected devices (such as NX, PX, and IPS) and process them against sophisticated detection logic to raise alerts in the NDR.

Detection capabilities

The anomaly detection is distributed across a shared docker container and few dedicated containers, each focusing on specific threat behaviors:

Container name

Description

ndr-detection-plugins

A shared docker container that hosts multiple plugins, such as the following:

  • ICMP Tunnel Plugin – Detects covert ICMP tunneling patterns.

  • NRD Plugin – Identifies newly registered domains often used in malicious campaigns.

  • SSL Anomalies Plugin – Flags suspicious SSL behaviors associated with DNS misuse.

  • TOR Plugin – Detects DNS traffic indicative of TOR network usage.

  • Phishing Exfiltration Plugin – Identifies DNS-based data exfiltration attempts.

  • DNS Hijacking – Alerts on unauthorized modification of DNS resolution paths.

  • DNS Poisoning – Detects cache poisoning attempts and manipulated DNS responses.

  • DNS Rebinding – Identifies attacks leveraging DNS rebinding techniques.

  • DNS Fast Flux – Flags flux-based evasion techniques used by botnets.

  • DCSync - Detection of DCSync attacks targeting Active Directory.

  • DCShadow - Detection of DCShadow attacks manipulating Active Directory replication.

dnst-detection

An individual container hosting DNS tunneling plugin for advanced identification of tunneling behaviors used for covert communication or data leakage.

dga-detection

An individual container hosting DGA plugin to detect Domain Generation Algorithm–based command-and-control domains used by modern malware

neurl-detection

An individual container hosting NeURL plugin, extending anomaly detection through neural-based analysis of DNS traffic patterns.

How the docker detection plugins work

When you have the required licenses, the plugins are downloaded automatically from the DTI gateway server.  The system is designed for zero-touch automation –

  1. The NDR automatically checks the Trellix Security Content Hub every 5 hours for new container images or logic updates.

  2. If an update is detected, the console stops existing containers, fetches the new Docker images, and restarts them automatically.

  3. When the NDR receives network events, it forwards them to these containers for real-time analysis.

  4. If a detection rule is matched, an alert is instantly generated and displayed on the UI.