DNS Gatekeeper Filtering for Unregistered Domain Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in efficiently filtering large volumes of network traffic using threat intelligence indicators due to the exponential growth of CTI data, leading to performance degradation and increased computational resource demands, particularly in mitigating DNS-based attacks.
Innovation Solution
Implementing probabilistic data structures like Bloom filters to efficiently determine packet matching with CTI-derived rules, reducing unnecessary searches and redundant storage by associating multiple threat indicators with a single rule, and deploying these filters at strategic network points to mitigate DNS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet filtering methods are used to filter network traffic against CTI-derived rules, then network security is maintained, but system performance degrades and computational resource demands increase exponentially as CTI data grows
Solution Approach 1:
The patent introduces Bloom filters as an intermediary data structure between the packet filtering system and the CTI database. This mediator enables efficient membership testing of domain names against the CTI database without requiring direct comparison with every individual indicator, thus maintaining security while reducing computational overhead and improving system performance as CTI data grows.
Solution Approach 2:
The patent creates a compressed probabilistic copy of the CTI database using Bloom filters. Instead of storing and searching the complete CTI database with all threat indicators, the system uses a compact Bloom filter representation that occupies minimal memory but enables fast membership testing, significantly reducing both memory requirements and search time while maintaining filtering accuracy.
2Speed
If complete CTI databases are stored in memory for fast packet filtering, then filtering speed is improved, but memory requirements become prohibitively large
Solution Approach 1:
The patent creates a compressed probabilistic copy of the CTI database using Bloom filters. Instead of storing and searching the complete CTI database with all threat indicators, the system uses a compact Bloom filter representation that occupies minimal memory but enables fast membership testing, significantly reducing both memory requirements and search time while maintaining filtering accuracy.
Solution Approach 2:
The patent changes the data representation parameters by transforming the CTI database into a Bloom filter structure with specific parameters (number of hash functions, filter size, false positive rate). This parameter transformation enables the system to achieve fast filtering speeds with dramatically reduced memory footprint by optimizing the balance between false positive rate and memory consumption.
3Quantity of substance
If probabilistic data structures like Bloom filters are used to reduce memory requirements, then memory efficiency improves, but false positive rates may increase affecting filtering accuracy
Solution Approach 1:
The patent changes the data representation parameters by transforming the CTI database into a Bloom filter structure with specific parameters (number of hash functions, filter size, false positive rate). This parameter transformation enables the system to achieve fast filtering speeds with dramatically reduced memory footprint by optimizing the balance between false positive rate and memory consumption.
Solution Approach 2:
The patent implements feedback mechanisms to monitor and adjust Bloom filter performance. By tracking false positive rates and filtering accuracy metrics, the system can dynamically adjust Bloom filter parameters or trigger retraining of machine learning models to maintain optimal filtering accuracy while preserving memory efficiency gains.
4Measurement precision
If machine learning models are trained on complete CTI datasets to improve threat detection accuracy, then detection precision improves, but training time and computational resources increase exponentially
Solution Approach 1:
The patent extracts and separates the domain name matching function from the complete CTI analysis pipeline. By using Bloom filters to handle the computationally intensive domain name membership testing separately, the system reduces the training data processing burden on machine learning models, thereby reducing training time and computational resource requirements while maintaining threat detection precision.
Solution Approach 2:
The patent segments the threat detection system into multiple independent components: Bloom filter-based domain name filtering, machine learning-based threat analysis, and packet inspection. This segmentation allows each component to be optimized independently, with the Bloom filter handling fast membership testing and the ML model focusing on sophisticated threat pattern recognition, reducing overall training time and computational overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The attack vectors for some denial-of-service cyber attacks on the Internet's Domain Name System (DNS) are bad, bogus, or unregistered domain name DNS requests to resolve domain names that are not registered in the DNS. Some other cyber attacks steal sensitive data by encoding the data in bogus domain names, or domain names otherwise not registered in the DNS, that are transferred across networks in bogus DNS requests. A DNS gatekeeper may filter in-transit packets containing DNS requests and may efficiently determine if a request's domain name is registered in the DNS. When the domain name is not registered in the DNS, the DNS gatekeeper may take one of a plurality of protective actions. The DNS gatekeeper drops requests determined not to be legitimate, which may prevent an attack.