DNS Control Module Detecting Fraudulent Requests via Preliminary Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious users exploit the DNS protocol to access communication networks without paying, generating significant revenue loss for operators and posing security risks by using DNS tunnels for fraud and malware transmission.
Innovation Solution
A control module is introduced to verify DNS requests against predetermined criteria, generating an incorrect response to fraudulent users while maintaining validity for the DNS resolution server, thereby detecting and mitigating DNS tunneling without disrupting legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DNS requests are allowed without verification, then network accessibility and DNS service speed are improved, but fraudulent access and revenue loss occur
Solution Approach 1:
The patent applies preliminary action by verifying DNS requests before processing them through the normal DNS resolution pathway. The control module checks criteria such as domain name patterns, query frequency, and source IP reputation in advance, preventing fraudulent requests from consuming network resources or generating harmful traffic before they can cause damage.
2Object-generated harmful factors
If a control module is introduced to verify DNS requests, then fraudulent access is prevented, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary control module that sits between the DNS resolver and the authoritative DNS servers. This mediator verifies DNS requests by checking domain names against known fraudulent patterns, analyzing query characteristics, and allowing legitimate requests to pass through while blocking malicious ones, thereby preventing fraudulent access without requiring complete redesign of the DNS infrastructure.
3Object-generated harmful factors
If DNS requests are blocked without verification, then fraudulent access is prevented, but loss of information increases
Solution Approach 1:
The patent applies local quality by implementing selective verification only for specific DNS request characteristics that indicate potential fraud, such as domain names matching known malicious patterns, unusually high query frequencies from single sources, or requests for domains not previously cached. Legitimate DNS requests that do not exhibit these characteristics are processed normally without additional verification overhead, minimizing information loss while preventing fraudulent access.
Data Source
Figure 1~2
Figure 3~5
Figure 4
AI summary
The invention relates to a method and a device for controlling a data flow transmitted according to the DNS protocol. Upon receipt (E32) of a DNS request sent by a terminal (TC) and directed to a DNS resolution server (RES), the DNS request comprising a question relating to a domain name, it is verified (E34) whether said DNS request satisfies at least one predetermined criterion, and when said DNS request verifies said at least one predetermined criterion, a DNS response is generated (E36), this DNS response being valid for the DNS resolution server and comprising at least one incorrect response element to said question included in said received DNS request. The DNS response is sent (E37) to said DNS resolution server before the DNS resolution server receives (E39) a response from an authoritative server in response to said DNS request.