DNS Query Modification for Malware Device Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in effectively identifying and managing malware-infected computing devices, particularly in preventing denial-of-service attacks by efficiently isolating and quarantining infected devices within a network.
Innovation Solution
A network device, such as a wireless router or gateway, is configured to modify DNS queries by adding user device identification information, allowing a DNS server to detect and mark potentially infected devices, thereby enabling efficient redirection and quarantine of malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DNS query processing is used without modification, then network devices cannot identify infected devices, but modifying DNS queries to add identification information increases processing complexity
Solution Approach 1:
The network device performs preliminary actions by modifying DNS queries in advance to include device identification information before the queries reach the DNS server. This allows the DNS server to identify potentially infected devices without adding complexity to its own processing, as the identification data is already embedded in the modified queries.
Solution Approach 2:
The network device acts as an intermediary between user devices and the DNS server. It intercepts DNS queries, adds device identification information, and forwards the modified queries to the DNS server. This intermediary role enables precise device identification while keeping the DNS server's processing simple, as it only needs to read the added identification fields.
2Productivity
If all devices are monitored and managed as batches, then management is simpler, but individual infected devices cannot be efficiently isolated
Solution Approach 1:
The system segments the network management approach by device rather than managing all devices as a single batch. Each DNS query is processed individually with device-specific identification information added, enabling the DNS server to identify and isolate infected devices on a per-device basis while maintaining efficient processing through automated marking and redirection mechanisms.
3Reliability
If infected devices are not identified and isolated, then network operations continue normally, but denial-of-service attacks can occur
Solution Approach 1:
The system performs preliminary detection by analyzing DNS queries for signs of malware infection before infected devices can cause denial-of-service attacks. The network device modifies queries to include identification information, and the DNS server compares this information against known malware patterns, enabling early detection and isolation of infected devices to prevent network-wide attacks.
Data Source
AI summary
Various examples described herein are directed to identifying a particular computing device, such as a computing device having malware. A DNS query may be received with a token identifying an originating computing device. The DNS query may be compared to a list of domain names associated with particular characteristics, such as having malware. The token may be used to identify the originating computing device and perform further actions.