DNS Hijacking Detection via Group Resolution and Legitimacy Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS hijacking, a common cyber-attack where attackers redirect DNS queries to malicious servers, is difficult to detect as it can be easily disguised as legitimate DNS manipulation, leading to phishing and identity theft.
Innovation Solution
A system and method that involves resolving domain names in a hijack target group list to IP addresses, checking these against a blacklist, and determining if legitimate reasons exist for common IP addresses, with a control group list to distinguish between malicious and legitimate DNS manipulations, thereby reporting DNS hijacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If DNS queries are redirected to attacker-controlled servers, then the attacker can perform phishing and identity theft, but legitimate DNS functionality is compromised
Solution Approach 1:
The patent performs preliminary DNS resolution of domain names to IP addresses before actual web browsing occurs. By pre-resolving domain names and checking them against known malicious IP address databases, the system identifies potential hijacking before the user interacts with the malicious site, preventing phishing and identity theft while preserving legitimate DNS functionality through proactive security checks
Solution Approach 2:
The patent introduces an intermediary security scanning system that sits between the user's DNS resolver and the actual DNS servers. This intermediary layer resolves domain names, compares the results against trusted databases of malicious IPs, and blocks access to hijacked domains while allowing legitimate DNS queries to proceed normally, thus mediating between security requirements and DNS functionality
2Measurement precision
If DNS hijacking detection is performed, then malicious IP addresses can be identified, but false positives may occur from legitimate DNS manipulations
Solution Approach 1:
The patent implements feedback mechanisms where DNS resolution results are continuously compared against updated databases of known malicious IP addresses. The system learns from confirmed hijacking patterns and adjusts its detection criteria, providing feedback loops that improve detection accuracy while filtering out legitimate DNS manipulations through iterative refinement of detection algorithms
Solution Approach 2:
The patent changes detection parameters by using multiple criteria including IP address reputation scores, domain age, registration information, and resolution patterns. By adjusting and weighting multiple parameters rather than relying on a single threshold, the system achieves higher detection precision while reducing false positives from legitimate DNS manipulations that may match single-criteria thresholds
3Difficulty of detecting and measuring
If multiple domain names are resolved to check for common IP addresses, then DNS hijacking can be detected, but the complexity of the detection system increases
Solution Approach 1:
The patent merges multiple domain name resolutions into a single batch operation, resolving multiple domain names simultaneously and comparing their IP addresses in one unified process. This combining approach maintains comprehensive detection capability while reducing system complexity by eliminating the need for separate resolution and comparison operations for each domain name
Solution Approach 2:
The patent creates a universal detection mechanism that handles multiple domain names through a single multi-functional resolution process. The same resolution and comparison infrastructure is used whether checking one domain or many, making the system scalable without proportionally increasing complexity. The universal approach allows the system to detect various types of DNS hijacking patterns using the same core functionality
Data Source
AI summary
Detecting a Domain Name Service (DNS) hijacking includes resolving names in a hijack target group list to their respective Internet Protocol (IP) addresses. In response to determining that two names in the hijack target group list resolved to a common IP address, a determination is made whether a legitimate reason exists for the two names in the hijack target group list to resolve to the common IP address. In response to determining that a legitimate reason does not exist for the two names in the hijack target group list to resolve to a common IP address, a DNS hijacking is indicated.