DNS Query Classification for Obscured Enterprise Devices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing device classification methods, particularly in enterprise networks, face limitations when devices intentionally obscure their information or abstain from sending requests to DHCP servers, necessitating a more robust and automated identification mechanism.

Innovation Solution

A system utilizing DNS query patterns through SLD-based, name-based, stat-based, and ensemble-based classifiers to categorize devices into IoT and non-IoT categories, and further into specific types like laptops, printers, and cameras, leveraging machine learning techniques for enhanced accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DHCP-based device classification is used, then device identification can be performed, but devices that intentionally obscure their information or abstain from sending requests cannot be identified

Engineering Contradiction:

Improvedevice identification reliabilityVSAvoidcoverage of obscure devices

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces DNS queries as an intermediary mechanism to classify devices that do not respond to DHCP requests. By monitoring DNS query patterns from devices, the system can identify and classify IoT devices even when they intentionally obscure their information or abstain from DHCP communication, thus resolving the contradiction between DHCP-based identification reliability and coverage of obscure devices

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the DHCP-based mechanical identification system with a DNS-query-based identification system. This substitution allows the system to capture devices that are invisible to DHCP mechanisms, thereby improving both the reliability and versatility of device classification without requiring direct interaction with the target devices through traditional DHCP protocols

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If multiple classifiers are integrated, then classification accuracy improves, but system complexity increases

Engineering Contradiction:

Improveclassification accuracyVSAvoidclassifier system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the device classification task into multiple specialized classifiers, each handling specific aspects of device identification. By dividing the complex classification problem into manageable segments (individual classifiers), the system achieves high accuracy through ensemble decision-making while keeping each component relatively simple and maintainable

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent merges multiple independent classifiers into an integrated ensemble system that combines their strengths. This merging allows the system to leverage diverse classification approaches simultaneously, achieving superior accuracy while managing complexity through modular architecture where each classifier operates independently but contributes to the overall decision

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS20260067225A1Device classification using DNS queries

Publication Date: 2026.03.05 INFOBLOX INC

AI summary

Techniques for providing device classification using DNS queries are disclosed. In some embodiments, a system, a process, and/or a computer program product for device classification using DNS queries includes receiving Domain Name System (DNS) network activity, wherein the DNS network activity includes a plurality of DNS queries; processing the DNS network activity using a plurality of classifiers; and automatically classifying one or more devices.