DNS Query Filtering for CDN Service Overload Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content providers face strain on computing resources due to high volumes of content requests, particularly during malicious attacks like DNS-based attacks, which can impact service level agreements and overall service provider functionality.
Innovation Solution
A service provider, such as a CDN service provider, manages request routing by selectively filtering DNS queries and distributing DNS server components to mitigate the impact of excessive requests, ensuring non-overlapping network addresses and implementing techniques like null route injection and router access control lists to filter or block excessive queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service providers process all DNS queries to maintain service quality, then service reliability is improved, but service provider overload occurs during malicious attacks
Solution Approach 1:
The patent implements selective filtering of DNS queries, processing only legitimate queries while discarding malicious ones. The system applies partial action by filtering based on criteria such as query rate thresholds, source IP reputation, and query pattern analysis, allowing the service provider to maintain reliability for legitimate users while rejecting excessive malicious requests that would cause overload
Solution Approach 2:
The patent introduces intermediary components including filtering systems, rate limiters, and analysis modules that stand between the DNS queries and the core service provider infrastructure. These intermediaries pre-process and filter queries before they reach the main processing system, protecting against overload while maintaining service quality for legitimate requests
2Productivity
If service providers increase processing capacity to handle high volume requests, then productivity is improved, but cost and complexity increase
Solution Approach 1:
The patent segments the DNS query processing system into distinct functional modules: filtering components that reject malicious queries, rate limiting modules that control query volumes, analysis systems that evaluate query legitimacy, and core processing components that handle legitimate requests. This segmentation allows each component to be optimized independently and prevents any single component from becoming a bottleneck or single point of failure
3Productivity
If service providers filter DNS queries to prevent overload, then service provider capacity is protected, but service reliability may be impacted due to false positives
Solution Approach 1:
The patent implements feedback mechanisms where the filtering system continuously monitors query patterns, analyzes the effectiveness of filtering decisions, and adjusts filtering criteria dynamically. Legitimate queries that were incorrectly filtered can be identified through feedback from users and system performance metrics, allowing the system to refine its filtering logic and reduce false positives over time while maintaining capacity protection
Data Source
AI summary
Generally described, the present disclosure is directed to managing request routing functionality corresponding to resource requests for one or more resources associated with a content provider. The processing of the DNS requests by the service provider can include the selective filtering of DNS queries associated with a DNS query-based attack. A service provider can assign DNS servers corresponding to a distributed set of network addresses, or portions of network addresses, such that DNS queries exceeding a threshold, such as in DNS query-based attacks, can be filtered in a manner that can mitigate performance impact on for the content provider or service provider.