DNS Request Interception for Malware Communication Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware communication with command and control centers often evades detection by using Domain Generation Algorithms, making it difficult for existing systems to block malicious domain names effectively.
Innovation Solution
A computing system intercepts DNS requests and determines IP address access based on security levels and historical domain name access, selectively blocking new domain names to prevent malware communication by comparing requested domain names to a list of previously accessed names, using a security module to update and manage security levels based on network traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Domain Generation Algorithms are used by malware to generate multiple domain names, then the malware's ability to communicate with command and control centers is improved, but the difficulty of detecting and blocking malicious communication increases
Solution Approach 1:
The system performs preliminary actions by maintaining a history of previously accessed domain names and proactively comparing new DNS requests against this history before allowing communication. This prevents malware from establishing new command and control channels while maintaining legitimate communications, resolving the contradiction by anticipating malicious behavior patterns rather than reacting to them after detection
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring DNS traffic patterns, updating the history of accessed domain names, and adjusting security decisions based on this accumulated information. This creates a closed-loop system that adapts to evolving malware techniques while preserving legitimate domain generation patterns, effectively countering Domain Generation Algorithms without blocking legitimate traffic
2Reliability
If the system blocks all new domain names to prevent malware communication, then cybersecurity protection is improved, but user access to legitimate websites is disrupted
Solution Approach 1:
The system applies local quality by differentiating between individual domain names based on their specific characteristics and history. Rather than applying a uniform block to all new domains, it selectively allows access to legitimate domains while blocking malicious ones, using the domain name history as a local identifier to make granular access decisions that protect security without disrupting user experience
Solution Approach 2:
The system changes parameters by using the domain name history as a dynamic parameter that evolves over time. Legitimate domains that are frequently accessed remain in the history and continue to be allowed, while malicious domains are identified through their absence from expected patterns or presence of suspicious characteristics, enabling adaptive security that responds to changing traffic patterns without manual intervention
3Measurement precision
If manual monitoring of domain names is performed to distinguish legitimate from malicious traffic, then detection accuracy is improved, but the time and resources required increase
Solution Approach 1:
The system implements self-service by automatically performing the monitoring and decision-making functions that would otherwise require manual IT personnel intervention. The domain name history and automated comparison logic enable the system to independently distinguish between legitimate and malicious traffic patterns, maintaining high detection accuracy while eliminating the time loss associated with manual monitoring
Solution Approach 2:
The system replaces the mechanical process of manual monitoring with an automated computational system. Instead of IT personnel reviewing and deciding on each domain name request, the system uses automated algorithms to compare requests against the domain name history and make real-time decisions, substituting human mechanical processes with efficient automated processing that maintains precision without the time cost
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples disclosed herein relate to determining whether to allow access to an IP address based on a security level and domain name access information. In one implementation, a processor intercepts a response to a Domain Name System request related to a domain name and updates a security level based on the request and/or response. The processor may determine whether to forward or block the response based on the security level and a comparison of the domain name to stored information related to previous domain name access.