Local DNS Reputation Engine for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques struggle to identify and block new, zero-day malware and malicious URLs from domain parking and inexpensive registered domains, as they require samples of existing malware and cannot predict which domains will be malicious, leading to delayed detection and potential infection.
Innovation Solution
A malware detection system that utilizes a local DNS reputation engine to monitor DNS traffic, generate a local DNS reputation, and issue alerts for abnormal activity, allowing for the detection of new malware without prior analysis, and can take actions such as blocking suspicious IP addresses or domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If antivirus software uses known virus signatures to detect malware, then detection accuracy for known viruses is improved, but the ability to detect new zero-day malware deteriorates
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing DNS traffic data before malware infection occurs. It builds a baseline reputation for domains and IPs by monitoring their DNS activity patterns in advance, enabling detection of zero-day malware without requiring prior virus samples or signatures.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring DNS traffic and updating domain/IP reputation scores based on observed behavior patterns. This feedback loop allows the system to adapt to new threats dynamically, improving detection of both known and unknown malware through learned behavioral patterns.
2Reliability
If a backend service monitors all domain names from registrars, then complete malware URL detection is improved, but system complexity and cost deteriorate
Solution Approach 1:
The invention extracts the malware detection functionality from the complex backend service and implements it locally on user computers. The local DNS reputation engine performs detection independently, eliminating the need for a centralized service to monitor all domain registrars while maintaining detection effectiveness.
Solution Approach 2:
Each user computer runs its own local DNS reputation engine that autonomously monitors and evaluates DNS traffic without requiring external backend services. The system serves itself by maintaining local reputation databases and making independent detection decisions, reducing overall system complexity.
3Speed
If DNS reputation analysis is performed on the client computer, then detection speed is improved, but client computer resource usage deteriorates
Solution Approach 1:
The local DNS reputation engine performs partial analysis by focusing only on DNS traffic relevant to malware detection rather than analyzing all computer activities. This selective approach enables fast detection while minimizing resource consumption on the client computer.
Data Source
AI summary
A DNS engine monitors domain name system (DNS) network activity occurring between a user computer and a remote computer server. The engine collects DNS traffic information during a specified time window at the user computer using the monitored DNS network activity. The engine generates a local DNS reputation for the user computer and stores the local DNS reputation on the user computer. When a triggering event is received at the user computer the engine determines that the triggering event is abnormal in comparison to the stored local DNS reputation. An alert is issued to a software product on the user computer. The engine takes an action using a software product upon the alert. The reputation may be a frequency distribution for each accessed domain name and IP address. A triggering event may be an abnormal access to a domain name or IP address, or a mismatch between DNS queries and DNS responses of the user computer.