DNS Integrity Check for Pharming Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to detect sophisticated pharming attacks that manipulate DNS settings by creating new hosts files or altering the Windows binary responsible for DNS resolution, evading previous security measures.
Innovation Solution
Implementing an integrity check function that monitors DNS-related network traffic and non-DNS traffic targeting routable IP addresses to detect malicious changes in name-to-IP resolution settings, including checks for domain name matching and IP address consistency, and triggering alerts for suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If monitoring only the hosts file is implemented, then detection of simple host file modifications is improved, but detection of sophisticated attacks creating new hosts files or altering Windows binary is worsened
Solution Approach 1:
The patent divides the DNS resolution verification into multiple independent components: (1) monitoring DNS-related network traffic, (2) monitoring non-DNS traffic targeting routable IP addresses, (3) comparing domain names with IP addresses, and (4) checking against known malicious patterns. This segmentation allows each component to specialize in detecting specific attack vectors without interfering with others, thereby improving both precision and versatility.
Solution Approach 2:
The integrity check function is designed to perform multiple detection functions simultaneously: it monitors both DNS and non-DNS traffic, detects modifications to hosts files, detects creation of new hosts files, and detects alterations to Windows binary. This multi-functional approach ensures comprehensive attack detection coverage while maintaining a unified security mechanism.
2Adaptability or versatility
If comprehensive monitoring of DNS and non-DNS traffic is implemented, then detection coverage is improved, but system complexity is worsened
Solution Approach 1:
The patent combines DNS traffic monitoring and non-DNS traffic monitoring into a single integrity check function that operates on both traffic types simultaneously. By merging these monitoring capabilities into one unified system rather than separate systems, the patent reduces overall system complexity while maintaining comprehensive detection coverage.
Solution Approach 2:
The integrity check function automatically performs domain name to IP address verification, compares results against known malicious patterns, and triggers alerts without requiring external intervention. This self-service capability reduces the operational complexity of the monitoring system while maintaining high detection coverage.
3Speed
If real-time integrity checking is implemented, then detection speed is improved, but processing overhead is worsened
Solution Approach 1:
The patent applies partial monitoring by focusing only on DNS-related network traffic and non-DNS traffic targeting routable IP addresses, rather than monitoring all network traffic. This selective approach enables real-time detection speed while minimizing processing overhead by excluding irrelevant traffic from analysis.
Solution Approach 2:
The integrity check function dynamically adjusts its monitoring parameters based on traffic characteristics, focusing computational resources on high-risk patterns such as domain names matching known malicious sites or IP addresses associated with pharming attacks. This parameter optimization enables fast detection while reducing overall processing overhead.
Data Source
AI summary
There provided a method, including executing on a processor the steps of: monitoring DNS related network traffic including domain name-to-IP key value pairs, monitoring at least such non-DNS related network traffic that is targeting routable IP addresses, determining whether the monitored non-DNS related network traffic is related to a domain name, in the event that the monitored non-DNS related network traffic is determined to be related to a domain name, searching the monitored DNS related network traffic for a matching domain name, in the event that the matching domain name is found in the search, determining whether IP addresses related to the matching domain names also match, and in the event that the IP addresses related to the matching domain names do not match, determining that an internal name-to-IP resolution from a local configuration file is used for the domain name and triggering an alert.