DNS Query Analysis for Detecting Compromised Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect compromised network devices using DNS tunneling, especially when data exchange volumes are small or domain names appear harmless, complicating detection.
Innovation Solution
A computer-implementable method using a neural network-based decision rule to identify malicious DNS queries, determining compromised devices by analyzing DNS traffic patterns and applying a pre-trained LSTM neural network to assess domain name suspiciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic volume analysis is used to detect DNS tunneling, then detection capability is improved for large data exchanges, but detection accuracy deteriorates for small data exchanges
Solution Approach 1:
The patent segments the detection approach into two independent parts: traffic volume analysis for large data exchanges and payload analysis for small data exchanges. This allows each method to operate optimally for its intended scope, with payload analysis specifically handling the detection of small data exchanges that volume analysis alone would miss.
Solution Approach 2:
The patent adds a new dimension to detection by analyzing the payload content of DNS queries alongside traffic volume. This dimensional expansion from solely volume-based detection to combined volume-and-content detection enables accurate identification of compromised devices even when data exchange volumes are small.
2Measurement precision
If payload analysis is used to detect DNS tunneling, then detection accuracy is improved for small data exchanges, but device complexity increases
Solution Approach 1:
The patent segments the detection system into distinct modules: traffic volume analysis module and payload analysis module. This segmentation allows the complex payload analysis to be isolated as a separate component that only activates when needed, reducing overall system complexity while maintaining high detection accuracy for small data exchanges.
Solution Approach 2:
The patent applies payload analysis only partially - specifically only when traffic volume indicators suggest potential compromise or when standard volume-based detection fails. This selective application of the more complex analysis method reduces unnecessary computational overhead while maintaining high detection accuracy where it matters most.
3Reliability
If statistical techniques are used to detect anomalous queries, then detection capability is improved, but adaptability deteriorates when intruders use harmless-looking domain names
Solution Approach 1:
The patent implements dynamic detection by continuously updating the list of known compromised devices and adapting the detection criteria based on observed patterns. This dynamic approach allows the system to adapt to new evasion techniques, including the use of harmless-looking domain names, by learning from and adjusting to changing attack patterns over time.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results are used to update the system's understanding of compromised devices and attack patterns. This feedback loop enables the system to adapt to intruder tactics, including the use of benign-appearing domain names, by continuously refining detection criteria based on actual observed behavior and outcomes.
Data Source
AI summary
A method and a computing device for identifying, in a network infrastructure, network devices compromised by DNS tunneling are provided. The method comprises: receiving a portion of traffic of the network infrastructure; identifying, from the traffic, a plurality of DNS queries having been generated by network devices of the network infrastructure; generating, by the processor, for a given one of the plurality of DNS queries, a respective set of feature; applying, by the processor, to the respective set of features, a pre-trained decision rule; in response to the pre-trained decision rule rendering a positive outcome, increasing a penalty score for a respective network device of the network infrastructure having transmitted the given one of the plurality of DNS queries; and in response to the penalty score associated with the respective network device exceeding a predetermined penalty score threshold, identifying the respective network device as being compromised.