DNS Resolver Traffic Screening for Real-Time Malicious IP Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing telecommunications networks lack effective real-time mechanisms to identify and disrupt malicious traffic, including malicious IP addresses and cyberattacks, which can compromise user devices and spread malware.
Innovation Solution
Implementing a system with servers and a resolver that utilize machine learning models to analyze network traffic in real-time, identify malicious IP addresses, and block access to malicious web pages or cyberattacks, leveraging DNS logs, user account records, and deep packet inspection to prevent the spread of malware across user devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time analysis of network traffic is implemented to identify malicious IP addresses, then protection effectiveness is improved, but system complexity and computational resources increase
Solution Approach 1:
The system segments the network traffic analysis function into a separate malicious IP address identification system that operates independently from the core DNS resolution process. This allows real-time security analysis without overloading the main DNS infrastructure, resolving the contradiction between protection effectiveness and system complexity.
Solution Approach 2:
An intermediary component is introduced between the DNS resolver and the malicious IP address database. This intermediary pre-processes and filters traffic, performing initial malicious IP address identification before queries reach the main system, thereby reducing computational overhead while maintaining effective protection.
2Measurement precision
If machine learning models are used to analyze network traffic in real-time, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary action by pre-processing network traffic data and pre-identifying potential malicious IP addresses before actual DNS queries are resolved. Machine learning models analyze traffic patterns in advance, building detection capabilities that enable rapid real-time identification without excessive processing delays during critical moments.
Solution Approach 2:
The system applies partial action by focusing machine learning analysis on specific high-risk traffic patterns and suspicious IP addresses rather than analyzing all network traffic equally. This selective approach maintains high detection accuracy for malicious traffic while reducing overall computational burden and processing time.
Data Source
AI summary
Aspects herein provide systems, devices, methods, and media for disrupting malicious traffic within a telecommunication network. In aspects, various mechanisms are deployed by a resolver server to identity malicious traffic and thwart malicious traffic.