DNS Proxy Service for Container Malware Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Container-based environments face threats from malware that communicate with command-and-control servers, and existing solutions struggle to effectively block malicious DNS requests, especially those generated by domain generation algorithms (DGAs), which can evade traditional filtering methods.

Innovation Solution

A DNS proxy service is injected into the container-based architecture to intercept and filter DNS requests, using a categorization module, DGA behavioral analysis engine, and policy server to classify requests and block malicious ones, preventing resolution to malign network locations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional DNS filtering methods are used, then simple malicious domain blocking is achieved, but DNS requests from domain generation algorithms (DGAs) cannot be effectively blocked

Engineering Contradiction:

Improvemalicious DNS request blocking effectivenessVSAvoidcapability to handle DGA-generated domains

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system transitions from static blacklist filtering to dynamic behavioral analysis. The DNS proxy service continuously monitors and analyzes DNS request patterns, adapting its filtering criteria based on observed behavior. This enables the system to dynamically identify and block DGA-generated domains that exhibit characteristic patterns such as high-volume requests to recently registered domains, without requiring pre-configured blocklists.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

A DNS proxy service is introduced as an intermediary component between the containerized application and the native DNS server. This proxy intercepts all DNS requests, analyzes them for malicious patterns, and only forwards legitimate requests to the upstream DNS server. The proxy acts as a intelligent mediator that can block malicious domains while allowing legitimate traffic to pass through unchanged.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If DNS proxy service is introduced to filter requests, then malicious DNS requests are blocked, but system complexity increases

Engineering Contradiction:

Improvecontainer security against malwareVSAvoidDNS filtering architecture complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The DNS filtering functionality is segmented into a separate, standalone DNS proxy service that operates independently from both the containerized applications and the native DNS server. This modular architecture allows the proxy to be deployed, configured, and maintained separately, reducing the complexity burden on existing systems while providing enhanced security capabilities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The DNS proxy service serves as an intermediary layer that simplifies the overall system architecture by centralizing the filtering logic. Rather than requiring modifications to multiple components or complex integration between security tools, the proxy handles all filtering operations in a single, manageable service that can be configured through policy files or administrative interfaces.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If all DNS requests are analyzed in detail, then accurate malicious request identification is achieved, but processing time increases

Engineering Contradiction:

ImproveDNS request classification accuracyVSAvoidDNS request processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The DNS proxy service applies partial analysis by focusing computational resources on suspicious requests rather than uniformly analyzing all DNS queries. Legitimate requests from approved domains are forwarded with minimal processing, while requests exhibiting potential malicious characteristics (such as domains from unknown registrars, high entropy domain names, or patterns matching known malware families) undergo detailed behavioral analysis. This selective approach maintains accuracy for malicious detection while minimizing overall processing time.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20230319093A1Containerized network activity filtering

Publication Date: 2023.10.05 SOPHOS LTD

AI summary

Systems and methods for operating a container-based architecture. The methods include executing, using one or more processors, instructions stored on memory to provide a Domain Name Service (DNS) proxy service, wherein the DNS proxy service is executed in a container-based architecture; and receiving at the DNS proxy service a domain name service (DNS) request, wherein the DNS request is received from an application service executing in the container-based architecture and the DNS request is directed to a DNS service being executed in the same container-based architecture as the DNS proxy service. The methods further include analyzing, at the DNS proxy service, the received DNS request to determine whether the DNS request is intended for a malign network; assigning a classification to the DNS request using the DNS proxy service, wherein the assigned classification is based on the analysis of the received DNS request to determine whether the DNS request is intended for a malign network location; and processing the DNS request based on the assigned classification of the DNS request.