DNS Greylisting for Botnet Domain Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-virus solutions fail to effectively address the evolving tactics of botnets, which use dynamic domain name generation algorithms to evade detection and maintain control over compromised machines, leading to difficulties in identifying and disrupting botnet operations.
Innovation Solution
Implementing a DNS grey listing system that temporarily blocks newly resolved domain names suspected of being part of a botnet, using heuristics such as n-gram analysis and domain registration data to differentiate between legitimate and malicious domains, and redirecting malicious traffic to a sinkhole server for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional anti-virus solutions are used to detect botnets, then detection capability is limited, but botnets can evade detection using dynamic domain generation algorithms
Solution Approach 1:
The DNS greylisting system performs preliminary action by temporarily blocking newly resolved domain names before they can be used by botnets. When a new domain is resolved, it is added to a greylist cache and blocked for a predetermined period (e.g., 24 hours), preventing botnets from establishing communication through dynamically generated domains while allowing legitimate traffic to proceed after the blocking period.
2Reliability
If all newly resolved domain names are blocked to prevent botnet operations, then botnet detection improves, but false positives increase and legitimate traffic is disrupted
Solution Approach 1:
The system applies partial blocking action by temporarily blocking only newly resolved domain names for a predetermined short period rather than permanently blocking all suspicious domains. This partial action (temporary greylisting) is sufficient to disrupt botnet operations while minimizing impact on legitimate traffic, as genuine services will have their domains resolved again and removed from the greylist.
Solution Approach 2:
The DNS greylisting system implements dynamic domain name blocking where the blocking status of domain names changes over time. Domains are dynamically added to the greylist cache when first resolved and automatically removed after the predetermined blocking period expires. This dynamic approach allows the system to adapt to new botnet domains while automatically restoring access for legitimate services.
3Reliability
If DNS greylisting is implemented to block dynamic domain names, then botnet operations are thwarted, but system complexity increases
Solution Approach 1:
The DNS greylisting system introduces an intermediary component between the DNS resolver and botnet command servers. The greylist cache acts as a mediator that intercepts DNS queries for newly resolved domains, returns false replies to block botnet communication, and automatically removes domains from the greylist after the predetermined period. This intermediary approach provides sophisticated botnet detection without requiring complex analysis of each domain's legitimacy.
Data Source
AI summary
To circumvent being blacklisted by an ISP, some viruses use a domain name generator algorithm or a domain generator algorithm (DGA). In an example, the DGA may use the current date and time to generate a random domain name based on the date. So for a given date, the botnet registers a particular domain in order to control the Trojan horse virus. The domain name that the botnet uses typically changes every day, which helps circumvent blacklisting. To counteract that, the disclosed systems and methods of DNS greylisting place a domain name in a grey list for a time period, for example a day, that the domain is resolved by the ISP. The first time the ISP experiences a customer trying to contact a particular domain, the ISP prevents the domain from resolving. After the time period (for example, 24 hours) expires, the domain is allowed to resolve normally.