Recursive DNS Attack Detection via Traffic Baseline Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions are ineffective in detecting and mitigating recursive DNS attacks, which exploit recursive DNS resolvers to overwhelm authoritative DNS servers, causing denial-of-service for legitimate users.
Innovation Solution
A method and system for detecting and mitigating recursive DNS attacks by learning baseline rates and invariants of DNS features, monitoring DNS traffic, analyzing anomalies using detection functions, and performing mitigation actions such as filtering out malicious queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If recursive DNS resolvers process all incoming DNS queries, then legitimate users can resolve domain names, but the resolvers become vulnerable to overload from malicious query floods
Solution Approach 1:
The system performs preliminary learning of normal DNS traffic patterns and establishes baseline rates and invariants before the attack occurs. This pre-established knowledge enables the detection system to quickly identify anomalies during an attack without needing to process and analyze each query in real-time, allowing the resolver to maintain service availability while filtering malicious traffic
Solution Approach 2:
The patent introduces an intermediary detection system that sits between the DNS resolver and the incoming traffic. This intermediary analyzes queries against learned baselines and filters out malicious traffic before it reaches the resolver, protecting the resolver from overload while allowing legitimate queries to pass through unchanged
2Reliability
If black lists are used to block known malicious domain names, then some attacks can be prevented, but the solution is not comprehensive and can be easily exploited
Solution Approach 1:
Instead of relying on static black lists of domain names, the system changes the detection parameters to include baseline rates of queries, responses, and cache hits, as well as invariants like the ratio of queries to cache hits. These parameter-based detection criteria enable the system to identify malicious traffic patterns regardless of the specific domain names involved, providing comprehensive coverage against both known and novel attacks
Solution Approach 2:
The detection system automatically learns and updates its own detection criteria by continuously monitoring DNS traffic patterns and refining its understanding of normal versus abnormal behavior. This self-learning capability eliminates the need for manual black list maintenance and enables automatic adaptation to new attack patterns without human intervention
3Measurement precision
If rate-based detection is used to identify flood attacks, then high-volume attacks can be detected, but recursive DNS attacks with normal rates are not detected
Solution Approach 1:
The system transitions from single-dimensional rate-based detection to multi-dimensional analysis by incorporating multiple detection criteria simultaneously: baseline query rates, response rates, cache hit rates, and their interrelationships. This dimensional expansion allows the system to detect attacks that maintain normal overall rates but exhibit abnormal patterns in specific dimensions, such as unusually high query volumes for non-cached domains
4Measurement precision
If manual intervention is used to distinguish attack queries from legitimate queries, then accurate detection is possible, but the process is not automated and requires human expertise
Solution Approach 1:
The detection system automatically learns normal traffic patterns and establishes baseline metrics without human intervention. It then uses these baselines to automatically detect and respond to attacks in real-time, eliminating the need for manual query analysis while maintaining high detection accuracy through continuous automated monitoring and adaptation
Data Source
AI summary
A method and system for detecting domain name system (DNS) recursive cyber-attacks are presented. The system includes learning a plurality of baselines of at least rates and rate invariants of DNS features; monitoring DNS traffic directed to and from a DNS resolver, wherein the DNS resolver is communicatively connected between at least one client and at least one name server; analyzing the monitored DNS traffic using at least one detection function to detect an anomaly based in part on at least one baseline of the plurality of learnt baselines; and upon detection of at least one anomaly, performing at least one mitigation action to filter out incoming DNS queries to a domain name under attack.