DNS Failed-Query Detection for Expired Domain Threat Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions fail to reliably detect and respond to unregistered or expired domain addresses, which are exploited for malicious activities such as SSRF server-side request forgery, command injection, and API key harvesting, due to their inefficiency in recognizing these domains.
Innovation Solution
A method and arrangement for threat detection that involves collecting DNS queries, identifying failed queries, determining if they relate to expired or unregistered domains, generating alerts, and taking actions such as automatic registration to prevent malicious use, using EDR and MDR services for process identification and behavior analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current cybersecurity solutions use traditional threat detection methods, then they can detect known malware patterns, but they fail to reliably detect unregistered or expired domain addresses
Solution Approach 1:
The system performs preliminary verification of domain registration status before allowing connections. By checking whether domains are registered, expired, or unregistered before the actual connection occurs, the system prevents potential attacks from unregistered domains while maintaining normal operation for legitimate sites.
Solution Approach 2:
The patent introduces an intermediary verification layer between the client and the target server. This intermediary checks domain registration status and acts as a mediator that can block or allow connections based on the domain's legitimacy, thereby detecting unregistered domains without requiring direct client-server authentication.
2Reliability
If client software performs server authentication, then security improves, but most client software does not implement server authentication
Solution Approach 1:
The system provides self-service security by automatically verifying domain registration status without requiring manual authentication configuration in client software. The verification process is transparent to the user and automatically blocks connections to unregistered domains, maintaining security while preserving ease of operation.
3Reliability
If vulnerability management systems systematically scan and assess vulnerabilities, then attack surface is reduced, but they cannot detect unregistered or expired domains
Solution Approach 1:
The patent extends vulnerability management capabilities to include domain registration status verification. By making the detection system universal, it can now handle both traditional vulnerabilities and unregistered domain threats using the same framework, thereby enhancing detection scope without sacrificing reliability.
4Reliability
If EDR and MDR services continuously monitor and analyze data, then attack detection capability improves, but complexity of data processing increases
Solution Approach 1:
The system extracts the domain registration verification function from the complex EDR/MDR data processing pipeline. By separating this specific verification task, the main processing pipeline remains focused on behavioral analysis while the registration check operates as a standalone, simple verification mechanism that doesn't increase overall system complexity.
Data Source
AI summary
A computer-implemented method, system, and computer-readable medium for threat detection in a computer or computer network are disclosed, comprising collecting DNS (Domain Name System) queries and/or information relating to DNS queries, identifying failed queries from the collected DNS queries and/or from information relating to DNS queries, and determining whether a domain related to the failed DNS query is related to an expired and/or unregistered domain, e.g. from a domain name related database.