DNS-Based Malicious Communication Prevention System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls are ineffective in preventing malicious communications initiated by users, as they do not restrict outward communications, and hackers exploit DNS linking behaviors to embed malicious software by redirecting IP addresses, making it difficult to protect against attacks.
Innovation Solution
A method and system that involve setting a specific IP address and TTL threshold, using a safe module embedded in a DNS to redirect malicious communications to a redirected IP address, and logging the content for anti-hacking techniques, utilizing a query checking unit and response checking unit to identify and prevent malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If firewalls are used to protect network infrastructure, then protection against outside hackers is improved, but protection against malicious communications initiated by users is worsened
Solution Approach 1:
The system segments the firewall function into two parts: the traditional firewall for blocking incoming connections, and a new DNS-based security module for filtering outgoing connections. This segmentation allows each component to specialize in its respective threat type without compromising the other's effectiveness
Solution Approach 2:
The patent introduces a DNS server as an intermediary between the user's computer and the Internet. The DNS server acts as a mediator that can inspect and control outgoing connection requests by resolving domain names to IP addresses, thereby preventing malicious communications while allowing legitimate traffic to pass through
2Ease of operation
If DNS is used to translate domain names to IP addresses, then user convenience is improved, but vulnerability to malicious software embedding is worsened
Solution Approach 1:
The system performs preliminary security checks on domain names before resolving them to IP addresses. The DNS server预先 (in advance) validates whether the requested domain name is legitimate or potentially malicious, and only then proceeds with the translation. This preliminary action prevents users from being redirected to harmful sites while maintaining the convenience of domain name usage
Solution Approach 2:
The DNS server serves as an intermediary that stands between the user's domain name input and the actual IP address resolution. It intercepts DNS queries, checks them against a database of known malicious domains, and either blocks or allows the resolution based on the check result, thereby protecting users from malicious software while preserving ease of use
3Adaptability or versatility
If Dynamic DNS is used to redirect IP addresses, then flexibility in server maintenance is improved, but exploitation by hackers for malicious connections is worsened
Solution Approach 1:
The system implements feedback mechanisms where the DNS server continuously monitors and logs DNS query patterns and resolution results. This feedback allows the system to detect abnormal redirection patterns that may indicate hacker exploitation, and to adjust its filtering rules accordingly to block malicious uses while preserving legitimate Dynamic DNS functionality
Solution Approach 2:
The DNS server acts as an intermediary that controls and monitors all IP address redirections, including Dynamic DNS updates. It validates DDNS requests against security policies and blocks suspicious redirections that hackers might use to establish command-and-control channels, while still allowing legitimate server maintenance activities to proceed
Data Source
AI summary
A system for preventing malicious communication includes a safe module set with a specific Internet Protocol address and a Time to Live threshold value of the specific IP address to determine whether a malicious communication exists. If the malicious communication exists, the safe module can re-direct the malicious communication to a recording module of the system for recording the content of the malicious communication.