Localized DNS Caching for Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing concern of cyberattacks on the Internet due to hackers hijacking traffic to malicious websites, leading to potential data theft and malware installation, necessitates effective blocking of such malicious traffic.
Innovation Solution
Implementing a system that intercepts internet traffic using an inspection agent, which caches domain/host names and IP addresses, and redirects suspicious IP-only access requests to a proxy server for further inspection, preventing access to potentially malicious websites by determining the legitimacy of the IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS translation is performed for every IP address without domain name, then traffic inspection can be performed, but system complexity increases due to additional inspection agents and proxy servers
Solution Approach 1:
The inspection agent performs preliminary actions by intercepting DNS queries before they reach the proxy server. When a DNS query contains only an IP address without a domain name, the inspection agent performs reverse DNS lookup and caching in advance, so that when the proxy server receives the request, the domain name information is already available in the cache, eliminating the need for complex real-time resolution mechanisms.
Solution Approach 2:
The inspection agent acts as an intermediary component between the client and the proxy server. It intercepts DNS queries, performs reverse lookups, and caches the results. This intermediary function allows the proxy server to focus solely on traffic inspection without needing to handle complex DNS resolution logic, thereby reducing overall system complexity while maintaining inspection accuracy.
2Reliability
If reverse DNS lookup is performed for every IP address, then legitimate traffic can be distinguished from malicious traffic, but processing time increases
Solution Approach 1:
The inspection agent performs reverse DNS lookup in advance when it intercepts a DNS query containing only an IP address. By completing this time-consuming operation beforehand and caching the result, the system avoids performing the same lookup again for subsequent requests, thereby reducing processing time while maintaining accurate traffic validation.
Solution Approach 2:
Instead of performing the expensive reverse DNS lookup operation every time a proxy server needs to validate an IP address, the inspection agent creates a copy of the resolution result by caching it in a localized DNS cache. This cached copy can be quickly retrieved and used for multiple requests, eliminating the need for repeated time-consuming lookups while ensuring consistent and accurate traffic validation.
Data Source
AI summary
An approach is proposed to support Internet traffic inspection to detect and prevent access to blocked websites or resources. First, access requests initiated by users to websites hosted on servers over a network are intercepted by an inspection agent, which identifies and caches a pair of the domain/host name of each website and its corresponding IP address on the Internet to a localized DNS cache. When a newly intercepted access request identifies the website by its IP address only without specifying its domain/host name, the inspection agent looks up the domain name by its IP address from the DNS cache. If no domain name is found, the inspection agent redirects the access request to a proxy server instead of forwarding it to the server hosting the website for further inspection. The proxy server then inspects the IP address to determine if it is a legitimate website or not.