DNS Query Interception for Wireless Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless communication devices face increasing security threats such as identity theft, malware, and phishing attacks due to their growing usage and connectivity, which existing technologies have not adequately addressed.
Innovation Solution
A security application installed on wireless communication devices or network devices intercepts DNS queries, identifies malicious URLs using machine learning models, and blocks access to prevent security incidents, providing additional services like advertisement blocking and identity theft monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If wireless communication devices access various Internet resources to improve service functionality, then service versatility is improved, but security vulnerability increases
Solution Approach 1:
A security application acts as an intermediary between the wireless communication device and Internet resources. The application intercepts DNS queries, analyzes them through machine learning models to identify malicious URLs, and blocks access to harmful sites while allowing legitimate traffic, thus mediating between service functionality and security protection
Solution Approach 2:
The security application performs preliminary analysis of DNS queries before the device accesses Internet resources. By using machine learning models to pre-identify malicious URLs and block them in advance, the system prevents security incidents before they occur, allowing the device to safely access legitimate resources
2Reliability
If security monitoring features are added to wireless communication devices, then security protection is improved, but device complexity increases
Solution Approach 1:
The security application serves as a separate intermediary component that handles security monitoring functions independently from the core device operations. This modular approach allows security protection to be added without fundamentally complicating the device's core architecture, as the security layer operates through DNS query interception and machine learning-based analysis
3Reliability
If DNS query interception and analysis are implemented, then malicious content blocking is improved, but processing time increases
Solution Approach 1:
The machine learning model is trained in advance on large datasets of malicious and legitimate URLs. During operation, the pre-trained model performs rapid classification of DNS queries, enabling fast identification and blocking of malicious content without requiring time-consuming analysis during the actual DNS resolution process
Solution Approach 2:
The system changes the parameter of DNS query processing by introducing machine learning-based classification. This transforms the traditional exact-matching DNS resolution process into a probabilistic classification task that can quickly assess the likelihood of malicious content, enabling fast blocking decisions with adjusted time parameters
Data Source
AI summary
A computer device may include a memory configured to store instructions and a processor configured to execute the instructions to receive a request from a user equipment (UE) device to resolve a Domain Name System (DNS) query for a Uniform Resource Locator (URL) and determine that the URL corresponds to a malicious URL. The processor may be further configured to select to not resolve the DNS query in response to determining that the URL corresponds to a malicious URL and send an indication to the UE device that the URL corresponds to a malicious URL.