DNS Analysis Engine for Malicious Software Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face challenges in detecting and mitigating malicious software, particularly botnets, which can exploit virtual machines and grow through cloning, posing a threat to network security and stability.
Innovation Solution
A DNS-analysis engine is employed to detect malicious software by identifying patterns in DNS request and response behavior, such as frequent, batched, or statistically random requests, independent of known command-and-control servers, using real-time or batch processing, and generating a confidence level report for corrective action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security tools are used to detect malicious software, then detection capability is limited, but false positives increase and detection precision deteriorates
Solution Approach 1:
The patent changes the detection parameters from static blacklist matching to dynamic behavioral analysis. It monitors multiple DNS request parameters including frequency, domain name structure, response patterns, and temporal characteristics. By analyzing these parameters collectively, the system achieves higher detection precision while reducing false positives, as malicious botnet behavior exhibits distinctive parameter patterns that differ from legitimate traffic.
Solution Approach 2:
The patent replaces traditional mechanical security tools (antivirus signatures, blacklist databases) with a statistical analysis system. Instead of relying on pre-defined signatures, it uses mathematical models to analyze DNS request patterns, calculate probabilities of malicious behavior, and generate confidence scores. This substitution enables more accurate detection of zero-day threats and reduces false positives from signature mismatches.
2Measurement precision
If comprehensive DNS traffic analysis is performed to improve detection accuracy, then detection precision improves, but processing time and system complexity increase
Solution Approach 1:
The patent applies partial action by selectively analyzing DNS requests based on risk indicators. Instead of deeply analyzing every DNS request, it identifies suspicious patterns (e.g., high-frequency requests, random domain generation, unusual response patterns) and focuses computational resources on those cases. This approach maintains high detection accuracy while significantly reducing average processing time for benign traffic.
Solution Approach 2:
The patent segments the DNS traffic analysis into multiple independent monitoring dimensions: request frequency analysis, domain name structure analysis, response pattern analysis, and temporal behavior analysis. Each dimension operates independently and contributes to the overall confidence score. This segmentation allows parallel processing of different analysis streams, improving efficiency while maintaining comprehensive detection accuracy.
3Speed
If real-time DNS monitoring is implemented to detect botnets quickly, then response speed improves, but system complexity and resource consumption increase
Solution Approach 1:
The patent implements self-service through automated confidence score calculation and threshold-based decision making. The system automatically monitors DNS traffic, calculates behavioral probabilities, compares them against thresholds, and generates alerts without requiring constant human intervention or complex configuration. This automation maintains real-time detection speed while reducing operational complexity.
Solution Approach 2:
The patent creates a universal DNS monitoring system that handles multiple detection functions through a single integrated platform. The same infrastructure monitors for botnet C&C communications, analyzes command-and-control patterns, detects cloning behaviors, and identifies various types of malicious DNS activity. This multi-functionality reduces overall system complexity compared to deploying separate specialized tools for each detection task.
Data Source
AI summary
A method and system are disclosed for detecting malicious software on host server computers or instances running on the host server computers. A pattern of behavior of how the malicious software makes Domain Name System (DNS) requests and/or responses can be used to detect the malicious software. The pattern of behavior can be based on actions that the tenants take in order to make the DNS requests, such as repeating the same requests at fixed time intervals, or requesting a plurality of DNS requests in batches, wherein at least a threshold percentage of which are not resolvable, or using statistically random domain names with the requests. The pattern of behavior can also be associated with responses to the DNS requests, such as when the response includes a text message, and the text message includes encrypted or statistically random data.