DNS Resolver Correlation Using Time-Sliced Access Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques are inadequate for identifying local resolvers contributing to malicious DNS traffic due to the client and resolver being separate components, making it difficult to correlate clients accessing resources through local resolvers.
Innovation Solution
A method involving pattern matching analysis is employed, where access patterns are determined over time slices, and responses from authoritative domain name servers are sent to local resolvers, with recorded requests analyzed to associate the local resolver with the client based on matching access patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If local resolvers are used as shared resources for multiple clients, then resource utilization and service availability are improved, but the ability to identify and correlate specific clients with resolver activities deteriorates
Solution Approach 1:
The system performs preliminary actions by embedding unique identifiers and access pattern information into DNS responses before they reach clients. The authoritative name server pre-configures responses with resolver identification data and time-sliced access patterns, enabling later correlation without requiring additional tracking infrastructure.
Solution Approach 2:
The patent introduces an intermediary mechanism through the modified DNS response structure that carries both resolver identification and access pattern information. This intermediary data layer enables correlation between clients and resolvers while maintaining the existing DNS protocol architecture and shared resource model.
2Productivity
If DNS queries are processed through shared local resolvers, then network infrastructure efficiency is improved, but security monitoring and malicious activity detection capability deteriorates
Solution Approach 1:
The system implements feedback mechanisms where the authoritative name server receives queries from local resolvers, processes them through time-sliced access patterns, and returns responses that include resolver identification and pattern information. This feedback loop enables security monitoring while maintaining efficient shared resolver operation.
Solution Approach 2:
The patent segments the DNS resolution process into distinct time slices and associates each segment with specific resolver activities. By dividing the access pattern into temporal segments, the system can monitor and analyze security-relevant behaviors without interfering with the overall efficient operation of shared resolvers.
3Measurement precision
If access patterns are tracked over time slices, then client-resolver correlation accuracy is improved, but system complexity and data processing requirements worsen
Solution Approach 1:
The system employs periodic time slices to organize and track access patterns. By dividing continuous monitoring into discrete periodic intervals, the system achieves precise correlation measurement while simplifying the data processing architecture through regular, manageable time segments rather than continuous complex tracking.
Data Source
AI summary
A computer implemented method correlates a local resolver to a client. The local resolver requesting an address to a resource from an authoritative domain name server is identified. An access pattern defining servers for accessing the resource over time slices is determined. The servers are assigned to the time slices and are configured to record requests to access the resource. Sending responses from the authoritative domain name server to the local resolver is initiated using the access pattern. Each response in the responses has the address to a server assigned to a current time slice during which a request for a new address is received from the local resolver. Whether the requests to access the resource from the client match the access pattern is determined. The local resolver is associated with the client in response to the requests matching the access pattern.