Augmenting Network Flow Records with Passive DNS Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems lack the ability to effectively utilize domain name information for real-time flow analysis and aggregation, leading to delayed DNS data collection and manual configuration requirements, which limits their ability to detect growing traffic trends and classify network traffic efficiently.
Innovation Solution
A method and system for encoding domain name information into flow records using a passive DNS database, allowing for real-time augmentation and aggregation of network flow data, enabling enhanced flow analysis and reporting without disrupting existing infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If domain name information is collected separately from flow data, then DNS data can be gathered, but real-time flow analysis and aggregation cannot be performed efficiently
Solution Approach 1:
The patent merges DNS data collection with network flow data collection by integrating a DNS listener into the NetFlow collection process. This allows domain name information to be captured at the same time as flow data, enabling real-time analysis without separate collection delays. The integration occurs at the data collection layer, where both types of information are gathered simultaneously from network traffic.
Solution Approach 2:
The patent performs preliminary DNS data collection and caching before flow analysis is needed. By continuously listening to DNS queries and pre-populating a local DNS database, the system ensures that domain name information is already available when flow records need to be analyzed, eliminating real-time collection delays.
2Extent of automation
If manual configuration is used for DNS data collection, then system complexity is reduced, but automation and real-time monitoring capabilities are limited
Solution Approach 1:
The system implements self-service automation by automatically listening to DNS queries, resolving domain names, and populating the local DNS database without manual intervention. The NetFlow collector automatically correlates flow data with DNS information, and the system self-manages the entire process from data collection to enhanced flow record generation, reducing the need for manual configuration while maintaining automation.
3Productivity
If DNS information is not integrated into flow records, then existing infrastructure can be maintained, but traffic trend detection and classification efficiency are reduced
Solution Approach 1:
The patent embeds DNS information within existing flow record structures by nesting domain name data inside the flow record format. This allows DNS information to be contained within the familiar NetFlow framework, enabling enhanced analysis capabilities without fundamentally changing the existing infrastructure. The nested structure permits both traditional flow analysis and new domain-based classification to operate simultaneously.
Data Source
AI summary
A method for encoding domain name information into flow records includes receiving a flow record. The flow record includes initial network flow information in a standard flow record format including at least a source address and a destination address. Domain name information associated with each of the source address and destination address is retrieved from a database. The domain name information is encoded into the received flow record while maintaining the initial network flow information to yield an enhanced flow record.