DNS Security via Query Size Analysis and Cache Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DNS security mechanisms are vulnerable to cyberattacks such as exfiltration, infiltration, and DNS tunneling, which allow attackers to extract or inject sensitive data, compromising network security.
Innovation Solution
A DNS system that monitors and records all queries between authoritative DNS servers and clients, using indicators like packet size and behavior analysis to detect anomalies and block malicious data transfers without disrupting normal traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DNS security mechanisms are used, then DNS service provides basic domain name resolution, but the system becomes vulnerable to cyberattacks such as exfiltration, infiltration, and DNS tunneling
Solution Approach 1:
The DNS server performs preliminary actions by maintaining a cache of previously resolved domain names and their corresponding IP addresses. When a DNS query arrives, the server first checks the cache before contacting the authoritative server, thereby preventing unnecessary external communications that could be exploited by attackers and reducing the attack surface.
Solution Approach 2:
The DNS server acts as an intermediary between clients and authoritative DNS servers. It receives queries from clients, checks its cache, and only contacts authoritative servers when necessary. This intermediary role allows the server to filter and control traffic, blocking malicious queries before they reach authoritative servers while still providing legitimate resolution services.
2Measurement precision
If the DNS server contacts authoritative servers for every unresolved domain name, then accurate IP address resolution is achieved, but the system exposes itself to attacks and increases network traffic
Solution Approach 1:
The DNS server performs preliminary resolution by maintaining a cache of previously obtained domain-to-IP mappings. When a query arrives, it first checks this pre-computed cache before contacting authoritative servers, thereby reducing the frequency of external communications and minimizing exposure to attacks while still providing accurate resolution for cached domains.
Solution Approach 2:
The DNS server performs partial resolution by satisfying queries from its cache without always contacting authoritative servers. While this means not all queries receive freshly resolved answers, the cache provides sufficiently accurate information for most legitimate domains, and the server only contacts authoritative servers when cache entries are missing or potentially stale, balancing accuracy with security.
3Speed
If the DNS server caches mapping information for frequently requested domain names, then query resolution speed is improved, but the server may store outdated or incorrect IP address mappings
Solution Approach 1:
The DNS server performs periodic validation of cached mapping information by checking whether cached domain-to-IP mappings are still valid before returning them to clients. This periodic verification ensures that cached data remains accurate while still providing fast resolution for valid cached entries, balancing speed and reliability.
Solution Approach 2:
The DNS server implements feedback mechanisms to monitor and validate cached mapping information. When queries are received, the server checks whether cached entries are still valid, and if not, it updates the cache with fresh information from authoritative servers. This feedback loop ensures cache accuracy while maintaining fast resolution performance for valid cached entries.
Data Source
AI summary
Method(s) and a domain name server (DNS) for detecting and blocking DNS query raised by a computing device are described. In an example implementation, the DNS may implement a method that includes monitoring DNS queries received from a computing device at the DNS. The DNS identifies if a fully qualified domain name (FQDN) associated with the DNS query is not present in a cache of the DNS and DNS responses received by the computing device in response to the DNS queries whose FQDN is not present in the cache. An exfiltration, an infiltration or a tunneling event is detected based on a summation of size of the DNS queries, DNS responses or both. Accordingly, further DNS queries from the computing device may be blocked.