DNS Proxy Service for Botnet Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet servers face challenges in defending against various attacks, such as botnets, SQL injection, and denial of service, due to their accessibility and vulnerability, which existing web application firewalls may not adequately address without requiring hardware or software installation.
Innovation Solution
An Internet-based proxy service that analyzes requests and responses, determining security threats and taking appropriate actions, such as blocking malicious requests, caching content, and modifying responses, without requiring customers to install hardware or software, by acting as a intermediary between client devices and origin servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web application firewalls are deployed to protect against attacks, then security is improved, but device complexity and installation requirements increase
Solution Approach 1:
The patent introduces a service server as an intermediary between DNS and the origin server. This service server acts as a mediator that receives DNS queries, determines whether they pose security threats, and either allows or blocks them. This intermediary approach provides security without requiring complex firewall hardware or software installation at the customer premises, thus resolving the contradiction between improved security and reduced device complexity.
2Reliability
If traditional firewalls are used, then network layer security is provided, but application level protection is insufficient
Solution Approach 1:
The service server performs multiple functions: it acts as a DNS resolver, a security filter, and a threat detection system. By combining these functions in a single service, it provides both network layer security (through DNS query filtering) and application level protection (through analysis of query content and patterns). This multi-functional approach resolves the contradiction between maintaining network layer security and adding application level protection.
3Measurement precision
If web application firewalls perform deep packet inspection, then attack detection capability is improved, but processing time and resource consumption increase
Solution Approach 1:
The service server performs partial deep packet inspection by analyzing only the necessary portions of DNS queries for threat detection. Rather than inspecting every byte of every packet, it focuses on specific query patterns, domains, and metadata that indicate potential threats. This selective inspection approach maintains high attack detection capability while minimizing processing time and resource consumption.
4Reliability
If customers install security software on their servers, then security protection is improved, but ease of operation deteriorates
Solution Approach 1:
The service server provides security protection as a standalone service that customers can access without installing software on their own systems. The service automatically performs security checks, threat analysis, and query filtering. Customers simply interact with the service through standard DNS protocols, making the system easy to operate while maintaining strong security protection. This self-service model resolves the contradiction between improved security and ease of operation.
Data Source
AI summary
A domain name is received from a customer. DNS is queried for multiple possible subdomains of the domain. For each subdomain that resolves, information about that subdomain's corresponding resource record is stored in a zone file that also includes a resource record for the domain name. The zone file is presented to the customer. A designation from the customer of which of the resource records are to point to an IP address of a proxy server is received. The resource records are modified according to the input of the customer and the zone file is propagated including the modified resource records.