DNS Reputation System for Spammer Domain Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DNS systems lack an effective method to detect and predict malicious or spammer domains by analyzing DNS queries, leading to potential security threats and inefficiencies in identifying and blocking suspicious domains.
Innovation Solution
A methodology that involves storing and filtering DNS requests, calculating popularity scores for unique lower-level domain names, and adding suspicious domains to a blocklist based on query volume and client behavior, utilizing a blacklist server and graph database to identify and predict malicious domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS systems store and analyze all DNS requests to detect malicious domains, then domain security detection capability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system segments DNS requests into two categories: those containing blacklist server domain names (higher level domain) and those that don't. Only the relevant segment is filtered and analyzed for malicious domain detection, reducing processing overhead while maintaining detection capability.
Solution Approach 2:
The patent introduces an intermediary analysis system that sits between the DNS server and the blocklist. This intermediary filters DNS requests, calculates popularity scores, and identifies suspicious domains before adding them to the blocklist, distributing the complexity across multiple components rather than concentrating it in one system.
2Measurement precision
If the system calculates popularity scores for all unique domain names, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system applies partial action by calculating popularity scores only for domains that appear in DNS requests containing blacklist server domain names, rather than calculating scores for all possible domains. This selective approach maintains detection accuracy for malicious domains while significantly reducing processing time and computational resources.
3Reliability
If the system adds suspicious domains to a blocklist based on popularity scores, then network security is improved, but false positive rate may increase
Solution Approach 1:
The system uses feedback mechanisms by continuously monitoring DNS requests and updating popularity scores based on observed query patterns. Domains are added to the blocklist only when their popularity scores exceed thresholds determined through continuous feedback from the DNS request analysis, reducing false positives while maintaining security.
Data Source
AI summary
The methodology for detecting spammer domains includes storing a plurality of DNS requests, wherein each DNS request comprises a combination of a higher level domain name and a lower level domain name, and wherein the higher level domain name corresponds to a blacklist server and the lower level domain name is a domain name that is to be used as a query directed towards the blacklist server, filtering the DNS requests to obtain a plurality of lower level domains, calculating a popularity score for each unique lower level domain name of the plurality of lower level domain names, determining whether a given unique lower level domain name is suspicious based on the popularity score, and when the given unique lower level domain name is determined to be suspicious based on the popularity score, adding the given unique lower level domain name to a blocklist.