DNS Firewall Intermediary for Exfiltration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewalls are unable to effectively block DNS-based attacks, such as data exfiltration and tunneling, due to the necessity of keeping port 53 open for DNS traffic, making enterprise networks vulnerable to malicious activities that exploit DNS requests and responses.
Innovation Solution
A method involving a DNS request analysis engine that examines DNS requests for suspicious characteristics, such as FQDN length and label quantity, and increments counts for suspicious domains, allowing for the detection and mitigation of DNS-based attacks by blocking further traffic to identified malicious domains before significant data compromise occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If port 53 is kept open to allow DNS traffic, then DNS-related services function properly, but the network becomes vulnerable to DNS-based attacks such as data exfiltration and tunneling
Solution Approach 1:
The patent introduces a DNS firewall as an intermediary component that sits between the network and the DNS resolver. This DNS firewall intercepts and inspects DNS requests before they reach the resolver, allowing it to block malicious DNS-based attacks while still permitting legitimate DNS traffic to pass through. The intermediary analyzes DNS request characteristics (such as domain name patterns, request frequency, and response size) to distinguish between benign and malicious traffic, thus resolving the contradiction by maintaining port 53 openness for legitimate services while filtering out harmful traffic through the intermediary layer
Solution Approach 2:
The patent applies parameter changes by monitoring and analyzing specific parameters of DNS requests and responses, such as domain name length, label count, request interval, and response size. By establishing thresholds for these parameters (e.g., blocking requests with domain names exceeding a certain length or requests made at abnormal intervals), the system dynamically adjusts traffic filtering based on parameter analysis. This allows legitimate DNS traffic to pass while blocking anomalous traffic patterns characteristic of data exfiltration and tunneling attacks
2Reliability
If conventional firewalls block traffic on certain port numbers, then security is improved, but DNS-related services fail to work properly
Solution Approach 1:
The patent segments the firewall functionality into two distinct components: a conventional firewall layer that blocks traffic based on port numbers and a specialized DNS firewall layer that inspects and filters DNS traffic specifically. By segmenting the security architecture this way, the conventional firewall can maintain its simple port-based blocking rules while the DNS firewall handles the complex task of analyzing DNS request characteristics. This segmentation allows DNS services to operate normally on port 53 while still providing comprehensive security through the specialized DNS inspection layer
Solution Approach 2:
The DNS firewall acts as an intermediary between the conventional firewall and the DNS resolver. It receives DNS requests that have passed through the conventional firewall, performs additional inspection specific to DNS protocols and patterns, and makes decisions about whether to allow or block the traffic. This intermediary approach enables the system to maintain simple conventional firewall rules for general security while adding sophisticated DNS-specific filtering without disrupting DNS service operation
3Measurement precision
If DNS requests are inspected and analyzed in real-time, then detection accuracy improves, but processing time and system complexity increase
Solution Approach 1:
The patent implements partial inspection by not analyzing every DNS request in the same depth. Instead, it uses a two-stage approach: first, it performs quick checks on basic parameters (such as domain name length and request interval) that can be evaluated rapidly; second, it applies more sophisticated analysis only to requests that exhibit suspicious characteristics or fail the initial checks. This partial action approach maintains high detection accuracy for malicious traffic while minimizing processing time for legitimate traffic, as most normal DNS requests pass through the faster initial filtering stage without requiring extensive analysis
Data Source
AI summary
Various embodiments of the invention disclosed herein provide techniques for managing a domain name system (DNS) based attack. An exfiltration and tunneling mitigation platform receives a first DNS request directed to a first domain name. The exfiltration and tunneling mitigation platform determines that a first characteristic associated with a first fully qualified domain name (FQDN) included in the first DNS request exceeds a first threshold value. In response, the exfiltration and tunneling mitigation platform computes a distance between the first FQDN and a second FQDN included in a second DNS request also directed to the first domain name. The exfiltration and tunneling mitigation platform increments a first count value associated with the first domain name based on the distance. At least one advantage of the disclosed techniques is that a DNS-based attack can be detected and mitigated before a significant amount of DNS exfiltration or DNS tunneling has occurred.