Boundary DNS Tracking for Accurate Compromised Host Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to accurately identify compromised hosts within a network system due to misidentification of internal DNS servers as compromised hosts, leading to ineffective threat elimination.
Innovation Solution
A boundary device determines compromised hosts by assigning a fake IP address corresponding to malicious domain names, allowing it to identify and log compromised hosts, and optionally obtain payload content for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the boundary device detects malicious domain names in DNS requests forwarded by the internal DNS server, then the detection capability is improved, but the internal DNS server is misidentified as the compromised host instead of the true compromised host
Solution Approach 1:
The patent introduces a fake IP address as an intermediary between the malicious domain name and the true compromised host. When the boundary device detects a malicious domain name in a DNS request from the internal DNS server, it assigns a fake IP address to that domain name and returns it to the internal DNS server, which then forwards it to the compromised host. The compromised host subsequently initiates a connection to this fake IP address, allowing the boundary device to trace the request back to the true compromised host rather than misidentifying the internal DNS server.
2Ease of operation
If the boundary device directly identifies the internal DNS server as compromised when detecting malicious domain names, then the detection process is simplified, but the threat elimination becomes ineffective
Solution Approach 1:
The patent applies preliminary action by pre-assigning fake IP addresses to malicious domain names before the compromised host initiates connection. When the boundary device detects a malicious domain name in the DNS request, it immediately assigns a fake IP address and records the mapping between the fake IP address, malicious domain name, and internal DNS server. This preliminary setup enables subsequent tracking of connection requests to the fake IP address, allowing the boundary device to identify the true compromised host when it attempts to connect, thus maintaining detection simplicity while improving threat elimination effectiveness.
3Measurement precision
If the boundary device processes all DNS requests and connection packets to identify compromised hosts, then the identification accuracy is improved, but the resource consumption increases
Solution Approach 1:
The patent applies local quality by making the boundary device's processing selective rather than universal. Instead of analyzing all DNS requests and connection packets equally, the boundary device focuses its processing power only on requests involving malicious domain names. When a malicious domain name is detected, the boundary device assigns a fake IP address and then specifically monitors connection requests to that fake IP address. This selective processing approach maintains high identification accuracy for compromised hosts while significantly reducing overall resource consumption by ignoring benign traffic.
Data Source
AI summary
In accordance with an embodiment, a method includes: receiving, from a host, a DNS domain name request forwarded by the internal DNS server; in response to a domain name carried in the DNS domain name request being a malicious domain name, determining a fake internet protocol (IP) address that is in a one-to-one correspondence with the malicious domain name; returning the fake IP address to the host via the internal DNS server; receiving a communication link establishment request packet from the host; and in response to a destination IP address in the communication link establishment request packet being the fake IP address, determining that the host is a compromised host.