DNS Query Interception for Spyware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing spyware detection systems are ineffective against sophisticated spyware that updates itself by downloading newer versions, often evading detection by altering binary layouts and using domain name service queries to communicate with its home servers, leading to information theft and self-updating.

Innovation Solution

Implementing an anti-spyware manager that monitors and intercepts domain name service resolution queries, redirecting queries for known spyware domain names to a honeypot server or the local host, preventing communication with the spyware home server and allowing identification and remediation of infected computers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based detection systems are used to detect spyware, then known spyware can be identified and eliminated, but sophisticated spyware that alters binary layouts and updates itself remains undetected

Engineering Contradiction:

Improvespyware detection effectivenessVSAvoidability to detect evolving spyware variants

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary action by monitoring DNS queries before spyware can successfully communicate with its home server. By intercepting and analyzing DNS queries in advance, the system can identify spyware attempts to contact known malicious domains before actual data exfiltration or updates occur, enabling proactive detection rather than reactive signature matching

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary layer by implementing a DNS query interception and redirection mechanism. This intermediary component sits between the spyware and the actual home server, monitoring DNS queries and redirecting them to honeypot servers. This intermediary approach allows detection without requiring direct observation of spyware binary signatures, solving the limitation of signature-based systems against evolving variants

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If spyware is allowed to communicate with its home server, then it can update itself and transmit stolen information, but blocking all DNS queries would prevent legitimate communication

Engineering Contradiction:

Improveinformation theft and spyware updatesVSAvoidnormal network communication functionality

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system applies local quality by differentiating between legitimate and malicious DNS queries based on domain name characteristics. Instead of blocking all DNS queries uniformly, the system selectively monitors and redirects only queries to domains on the spyware home server list, while allowing legitimate DNS resolution to proceed normally. This selective approach maintains ease of operation for legitimate communications while preventing harmful spyware updates

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system converts the harmful DNS queries from spyware into beneficial detection opportunities by redirecting them to honeypot servers. The spyware's attempt to contact its home server, which would normally enable information theft and updates, is instead redirected to a controlled honeypot environment where the query is detected and logged, transforming the harmful communication attempt into a detection signal

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Reliability

If DNS queries are monitored and redirected to honeypot servers, then spyware communication is prevented, but system complexity increases

Engineering Contradiction:

Improveprevention of spyware communicationVSAvoidDNS query monitoring and redirection system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system achieves multi-functionality by implementing a single DNS query monitoring and redirection mechanism that serves multiple purposes: detecting spyware attempts to contact home servers, identifying infected systems, preventing information theft, and blocking spyware updates. This universal approach consolidates multiple security functions into one system, reducing overall complexity compared to separate detection and prevention mechanisms

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system uses copying by creating honeypot servers that replicate the appearance and functionality of actual spyware home servers. These fake servers mimic the expected behavior of legitimate home servers, causing spyware to redirect its queries to the honeypot instead. The copying approach allows detection without requiring complex analysis of spyware behavior patterns, simplifying the monitoring system

Inventive Principle:

Principle #26Copying

Data Source

PatentUS7752664B1Using domain name service resolution queries to combat spyware

Publication Date: 2010.07.06 GEN DIGITAL INC

AI summary

An anti-spyware manager uses domain name service resolution queries to combat spyware. The anti-spyware manager maintains a list of domain names associated with spyware, monitors domain name service queries, and detects queries on domain names on the list. Responsive to detecting a domain name service query on a domain name associated with spyware, the anti-spyware manager forces the domain name service query to resolve to an address not associated with the domain name. Because attempts by spyware to communicate with its home server are now routed to the forced address, the spyware is unable to communicate with its homer server, and thus can neither steal information nor download updates of itself. Additionally, the anti-spyware manager can identify computers that are infected with spyware and clean or quarantine them.