DNS Gatekeeper Filtering for Bogus Domain Request Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat intelligence gateways (TIGs) face performance challenges in handling large volumes of CTI-derived packet filtering rules due to increasing network traffic and threat indicators, leading to high latency and packet drops, which are exacerbated by limited computational and memory resources.
Innovation Solution
Implementing probabilistic data structures like Bloom filters to efficiently determine packet matches, reducing unnecessary rule searches and redundant storage by associating multiple threat indicators with a single rule, and optimizing memory usage through hierarchical memory management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet filtering rules are used to handle threat indicators, then network security coverage is improved, but system latency increases and packet drops occur due to high computational overhead
Solution Approach 1:
The patent replaces traditional mechanical packet filtering mechanisms with a probabilistic data structure (Bloom filter) that uses bit manipulation and hashing to achieve constant-time lookups. This substitution transforms the linear search process into a probabilistic membership test, dramatically reducing computational overhead and latency while maintaining security coverage.
Solution Approach 2:
The patent changes the fundamental parameter of threat indicator storage from individual rule-based entries to a compact probabilistic data structure. By encoding multiple threat indicators into a fixed-size bit array using hash functions, the system achieves O(1) lookup time complexity, resolving the contradiction between comprehensive security coverage and low latency.
2Reliability
If comprehensive packet filtering rules are implemented to cover all threat indicators, then security efficacy is improved, but memory resource requirements increase
Solution Approach 1:
The patent merges multiple threat indicator storage requirements into a single probabilistic data structure. By combining the functionality of storing, searching, and managing numerous individual threat indicators into one Bloom filter structure, the system achieves space-efficient storage that scales logarithmically rather than linearly with the number of threat indicators.
Solution Approach 2:
The patent creates a compact probabilistic copy of the threat indicator database that can be rapidly queried without requiring the full original data structure. The Bloom filter serves as a space-efficient representation that enables fast membership testing while using minimal memory resources compared to storing complete rule sets.
3Measurement precision
If multiple threat indicators are associated with separate rules, then threat detection accuracy is improved, but rule search time and storage overhead increase
Solution Approach 1:
The patent performs preliminary hashing and bit placement of all threat indicators into the Bloom filter structure before actual packet filtering operations. This pre-processing action organizes threat indicators in a way that enables constant-time membership testing, eliminating the need for sequential rule searching during live traffic filtering while preserving detection accuracy.
Data Source
AI summary
The attack vectors for some denial-of-service cyber attacks on the Internet's Domain Name System (DNS) are bad, bogus, or unregistered domain name DNS requests to resolve domain names that are not registered in the DNS. Some other cyber attacks steal sensitive data by encoding the data in bogus domain names, or domain names otherwise not registered in the DNS, that are transferred across networks in bogus DNS requests. A DNS gatekeeper may filter in-transit packets containing DNS requests and may efficiently determine if a request's domain name is registered in the DNS. When the domain name is not registered in the DNS, the DNS gatekeeper may take one of a plurality of protective actions. The DNS gatekeeper drops requests determined not to be legitimate, which may prevent an attack.