Cyber Attack Evaluation via DNS Trace Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for evaluating cyber attacks using blacklists or Cyber Threat Intelligence struggle to determine the current effectiveness of indicators, as DNS traces can be ephemeral and difficult to verify, especially when domains are removed or blocked, making it challenging to distinguish between domain removal and blocking.

Innovation Solution

An information processing device that inquires about domain information across multiple cache DNS servers and passive DNS databases to evaluate the presence and history of IP addresses associated with malicious domains, calculating a no-answer ratio to determine the validity of DNS traces and diagnose cyber attack threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If DNS trace verification is performed using traditional blacklist methods, then the evaluation process is simple, but the ability to distinguish between domain removal and blocking is insufficient

Engineering Contradiction:

Improvedistinguishment accuracy between domain removal and blockingVSAvoidcomplexity of verification system

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The verification system is segmented into multiple independent DNS servers and passive DNS databases, each providing specific verification functions. This segmentation allows the system to cross-check domain information from multiple sources to distinguish between domain removal and blocking with higher precision while maintaining manageable complexity through modular architecture.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Passive DNS databases serve as intermediaries that store historical DNS resolution information. By introducing this intermediary layer, the system can compare current DNS queries against historical data to determine whether domains are blocked or removed, improving measurement precision without requiring direct complex interactions between all DNS servers.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple DNS servers and passive DNS databases are queried to verify domain traces, then the accuracy of threat diagnosis is improved, but the inquiry time and system complexity increase

Engineering Contradiction:

Improvereliability of cyber attack evaluationVSAvoidinquiry time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Passive DNS databases pre-store historical DNS resolution information before verification is needed. This preliminary action allows the verification system to quickly compare current domain queries against pre-existing historical data, reducing inquiry time while maintaining high reliability through comprehensive historical context.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system merges active DNS queries with passive historical DNS data into a unified verification process. By combining real-time DNS server responses with pre-collected passive DNS information, the system achieves high reliability through multiple verification sources while reducing total inquiry time by avoiding redundant queries.

Inventive Principle:

Principle #5Merging (Combining)

3Loss of information

If traditional blacklist methods are used without considering DNS trace verification, then the evaluation process is fast, but the ability to evaluate current effectiveness of indicators is insufficient

Engineering Contradiction:

Improveinformation completeness about indicator effectivenessVSAvoidevaluation speed

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The verification system uses automated DNS queries and passive DNS database lookups to self-verify the effectiveness of blacklist indicators. This self-service approach collects comprehensive information about domain current status and historical presence automatically, ensuring complete information about indicator effectiveness while maintaining evaluation speed through automation.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements feedback mechanisms where DNS query results and passive DNS data are analyzed to provide information about the current effectiveness of blacklist indicators. This feedback loop ensures complete information about whether indicators remain valid without significantly slowing down the evaluation process, as the feedback is generated through automated routine operations.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11503046B2Cyber attack evaluation method and information processing apparatus

Publication Date: 2022.11.15 FUJITSU LTD

AI summary

A evaluation method by a computer, the method includes: making, based on domain information included in input cyber attack information, an inquiry about whether an address associated with the domain information exists to multiple first servers that manage associations between the domain information and addresses; make an inquiry about an answer history related to the domain information to a second server that monitors communication of the first servers and manages answer histories, related to the associations between the domain information and the addresses, of the first servers; and outputting a result of diagnosing a threat detail of a cyber attack related to the domain information based on a ratio of the number of answers indicating that an address associated with the domain information does not exist with respect to the number of answers acquired from each of the first servers, and the answer histories acquired from the second server.