DNS Query Packet Filtering for DDoS Attack Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The Domain Name System (DNS) protocol, particularly using the User Datagram Protocol (UDP) for transport, is vulnerable to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, which overwhelm network resources and are difficult to identify and mitigate due to spoofed source IP addresses and high packet rates.

Innovation Solution

A method and system for detecting and mitigating DDoS attacks by analyzing DNS query packets for common features such as IP header fields, DNS data fields, and recursion desired fields, determining if they meet a predetermined threshold, and filtering out packets that share these features to reduce computational resource usage and bandwidth consumption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNS servers process all incoming DNS query packets, then service completeness is maintained, but computational resources and bandwidth are depleted during DoS attacks

Engineering Contradiction:

Improveservice completenessVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies preliminary action by analyzing DNS query packets for common features and patterns before fully processing them. The system performs preliminary filtering to identify and mitigate DoS attack traffic based on characteristics such as source IP addresses, query types, and temporal patterns, thereby preventing resource depletion before it occurs while maintaining service completeness for legitimate queries

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary filtering mechanism that sits between the incoming DNS queries and the authoritative DNS servers. This intermediary layer analyzes packet features, identifies attack patterns, and selectively blocks malicious traffic while allowing legitimate queries to pass through, thus protecting DNS servers from resource exhaustion without compromising service availability

Inventive Principle:

Principle #24Intermediary (Mediator)

2Use of energy by moving object

If DNS servers filter out suspicious packets, then resource protection is improved, but legitimate queries may be incorrectly blocked

Engineering Contradiction:

Improveresource protectionVSAvoidquery processing accuracy

Core Design Contradiction:

Use of energy by moving objectVSReliability

Solution Approach 1:

The patent applies parameter changes by dynamically adjusting filtering thresholds and parameters based on observed traffic patterns and attack characteristics. The system monitors DNS query features such as source IP distribution, query rate, and packet characteristics, modifying filtering parameters in real-time to optimize the balance between blocking attacks and allowing legitimate traffic, thereby reducing false positives while maintaining resource protection

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent implements feedback mechanisms where the filtering system continuously monitors the effectiveness of its actions and adjusts its behavior accordingly. By analyzing the outcomes of filtering decisions and observing traffic patterns, the system refines its filtering criteria to minimize false positives while maintaining effective DoS attack mitigation, ensuring high query processing accuracy

Inventive Principle:

Principle #23Feedback

3Difficulty of detecting and measuring

If source IP addresses are spoofed in DoS attacks, then attacker identification becomes difficult, but traffic filtering based on IP patterns can still detect attacks

Engineering Contradiction:

Improveattacker identification difficultyVSAvoidattack detection capability

Core Design Contradiction:

Difficulty of detecting and measuringVSObject-affected harmful factors

Solution Approach 1:

The patent applies dimensionality change by moving beyond traditional source IP address-based detection to analyze multiple dimensions of DNS traffic simultaneously. The system examines temporal patterns, spatial distribution across multiple DNS servers, query type distributions, and packet characteristic patterns, thereby detecting DoS attacks even when source IPs are spoofed by identifying coordinated anomalies across multiple dimensions that single-IP analysis would miss

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS10547636B2Method and system for detecting and mitigating denial-of-service attacks

Publication Date: 2020.01.28 VERISIGN INC

AI summary

A method of detecting a DDOS attack is disclosed. The method includes obtaining, at an authoritative DNS server, a plurality of DNS query packets from a plurality of DNS requestors over a communications network; analyzing, by an electronic processor, a set of the plurality of DNS query packets; determining, by an electronic processor, that a subset of the plurality of DNS query packets of the set meets a predetermined threshold for a rate of DNS queries; filtering the plurality of DNS query packets based on the determining to produce a filtered number of DNS query packets; and providing, by the authoritative DNS server, a DNS response for the plurality of DNS query packets that were filtered.