DNS-Based Hidden IP Detection for Malicious Site Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious sites hide their IP addresses using DNS services, making it difficult for investigation authorities to identify the servers operated by hackers, which poses a challenge in blocking and addressing such sites.
Innovation Solution
A method and apparatus that utilize DNS services to collect real IP addresses through port scanning, banner filtering, HTML filtering, and image filtering to identify the hidden IP addresses of malicious sites, involving operations such as collecting IP addresses via predefined service ports, extracting candidate groups based on response information, and determining the final IP address through similarity comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a DNS service is used to hide the real IP address of a malicious site, then the security against DDOS attacks and direct attacks is improved, but the ability of investigation authorities to find the IP address of the server operated by hackers deteriorates
Solution Approach 1:
The system performs preliminary actions by collecting real IP addresses through port scanning before the malicious site can hide them via DNS service. By proactively gathering IP addresses and performing banner filtering, HTML filtering, and image filtering in advance, the system preserves investigation capabilities while allowing the DNS service to provide security protection.
2Measurement precision
If port scanning and multiple filtering operations are performed to collect real IP addresses, then the ability to identify hidden IP addresses is improved, but the complexity of the detection system increases
Solution Approach 1:
The detection system is segmented into multiple independent filtering operations: port scanning, banner filtering, HTML filtering, and image filtering. Each filtering operation processes specific types of information separately, making the complex detection task more manageable and systematic while improving identification accuracy through cumulative filtering results.
Solution Approach 2:
The system uses intermediate filtering stages (banner filtering, HTML filtering, image filtering) as mediators between the initial port scanning and the final IP address identification. Each intermediary filtering operation refines the candidate IP addresses, gradually eliminating false positives while maintaining a structured approach to complex detection.
Data Source
AI summary
The present disclosure provides a method for finding a hidden IP address in a malicious site using a domain name system (DNS) service, which is executed by a computer. The method includes the operations of: collecting real IP addresses for servers based on a predefined service port; extracting a first IP address candidate group by performing banner filtering from the real IP addresses based on response information of a malicious site using a DNS service; extracting a second IP address candidate group by performing HTML filtering to verify whether the first IP address candidate group is similar to a HTML source of the malicious site; extracting a final IP address by performing image filtering to verify whether the second IP address candidate group is similar to an image of the malicious site; and determining whether the final IP address is a real IP address of the malicious site.