DNS Control Module Detecting Fraudulent Requests via Preliminary Verification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Malicious users exploit the DNS protocol to access communication networks without paying, generating significant revenue loss for operators and posing security risks by using DNS tunnels for fraud and malware transmission.

Innovation Solution

A control module is introduced to verify DNS requests against predetermined criteria, generating an incorrect response to fraudulent users while maintaining validity for the DNS resolution server, thereby detecting and mitigating DNS tunneling without disrupting legitimate traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If DNS requests are allowed without verification, then network accessibility and DNS service speed are improved, but fraudulent access and revenue loss occur

Engineering Contradiction:
ImproveDNS service speedVSAvoidfraudulent access
Core Design Contradiction:
ProductivityVSObject-generated harmful factors

Solution Approach 1:

The patent applies preliminary action by verifying DNS requests before processing them through the normal DNS resolution pathway. The control module checks criteria such as domain name patterns, query frequency, and source IP reputation in advance, preventing fraudulent requests from consuming network resources or generating harmful traffic before they can cause damage.

Inventive Principle:
Principle #10Preliminary action

2Object-generated harmful factors

If a control module is introduced to verify DNS requests, then fraudulent access is prevented, but device complexity increases

Engineering Contradiction:
Improvefraudulent accessVSAvoidDNS control system
Core Design Contradiction:
Object-generated harmful factorsVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary control module that sits between the DNS resolver and the authoritative DNS servers. This mediator verifies DNS requests by checking domain names against known fraudulent patterns, analyzing query characteristics, and allowing legitimate requests to pass through while blocking malicious ones, thereby preventing fraudulent access without requiring complete redesign of the DNS infrastructure.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Object-generated harmful factors

If DNS requests are blocked without verification, then fraudulent access is prevented, but loss of information increases

Engineering Contradiction:
Improvefraudulent accessVSAvoidlegitimate DNS queries
Core Design Contradiction:
Object-generated harmful factorsVSLoss of information

Solution Approach 1:

The patent applies local quality by implementing selective verification only for specific DNS request characteristics that indicate potential fraud, such as domain names matching known malicious patterns, unusually high query frequencies from single sources, or requests for domains not previously cached. Legitimate DNS requests that do not exhibit these characteristics are processed normally without additional verification overhead, minimizing information loss while preventing fraudulent access.

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3476107B1Method and device for controlling data flow transmitted according to the DNS protocol (domain name system)
Publication Date: 2021.10.20 ORANGE SA
  • EP3476107B1 patent drawingFigure 1~2
  • EP3476107B1 patent drawingFigure 3~5
  • EP3476107B1 patent drawingFigure 4

AI summary

The invention relates to a method and a device for controlling a data flow transmitted according to the DNS protocol. Upon receipt (E32) of a DNS request sent by a terminal (TC) and directed to a DNS resolution server (RES), the DNS request comprising a question relating to a domain name, it is verified (E34) whether said DNS request satisfies at least one predetermined criterion, and when said DNS request verifies said at least one predetermined criterion, a DNS response is generated (E36), this DNS response being valid for the DNS resolution server and comprising at least one incorrect response element to said question included in said received DNS request. The DNS response is sent (E37) to said DNS resolution server before the DNS resolution server receives (E39) a response from an authoritative server in response to said DNS request.