DNS Query Subfield Pattern Detection for DDoS Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS-based DoS attack mitigation systems fail to scale adequately and impose additional load on servers due to the need for just-in-time transfer of names, making them ineffective against attacks like DNS Water Torture and DNS Reflection/Amplification.
Innovation Solution
A system and method that segregates DNS query names into subfields based on zone cuts, analyzes these subfields independently, and generates verified regular expressions to create filters that block attacks by randomizing query name parts, reducing the need for just-in-time name transfers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If conventional DNS-based DoS attack mitigation systems use just-in-time transfer of names in DNS zones, then they can maintain pass-lists for millions of names, but they place extra load on already burdened servers and fail to scale adequately
Solution Approach 1:
The system performs preliminary analysis of DNS traffic patterns and pre-generates mitigation filters before attacks occur. By analyzing historical DNS query data and identifying potential attack patterns in advance, the system prepares filter rules that can be rapidly deployed when attacks are detected, eliminating the need for just-in-time name transfers during active attacks.
Solution Approach 2:
The system segments the DNS name space into hierarchical zones and analyzes traffic patterns at different levels. Instead of maintaining a single large pass-list for all names, the system divides the DNS namespace into manageable segments (zones, subzones, domains) and generates targeted filters for each segment, reducing overall storage requirements and improving scalability.
2Reliability
If conventional systems rely on just-in-time transfer of names in DNS zones, then they can respond to attacks, but the high load may prevent successful mitigation
Solution Approach 1:
The system pre-analyzes DNS traffic and pre-generates mitigation filters during low-load periods, so that when attacks occur, pre-computed filters are already available for immediate deployment. This eliminates the need for time-consuming just-in-time name transfers during high-load attack scenarios, ensuring reliable mitigation without compromising server performance.
Solution Approach 2:
The system creates simplified copies or representations of DNS name patterns (such as regular expressions or template-based filters) that capture attack characteristics without requiring storage or transfer of actual million-name pass-lists. These pattern copies can be rapidly processed and deployed, maintaining mitigation effectiveness while reducing server load.
3Measurement precision
If the system analyzes complete DNS query names, then it can detect attacks accurately, but it increases processing complexity and time
Solution Approach 1:
The system segments complete DNS query names into hierarchical components (zone, subzone, domain, hostname) and analyzes patterns at each level independently. This segmentation allows the system to detect attacks with high accuracy by examining specific segments that exhibit malicious patterns, while reducing processing complexity by avoiding analysis of entire long query names as single units.
Solution Approach 2:
The system extracts and focuses analysis on specific critical segments of DNS query names that are most indicative of attacks (such as the hostname portion or specific subzone levels). By extracting only the relevant segments for pattern matching, the system maintains high detection accuracy while significantly reducing processing complexity compared to analyzing complete query names.
Data Source
AI summary
A computer method and system for determining patterns in network traffic packets having structured subfields for generating filter candidate regular expressions for DDoS attack mitigation. Stored packets are analyzed to extract a query name for each stored packet. Each query name is segregated into subfields. A Results-table is generated utilizing the segregated subfields of the query names. A Field-length table is generated that contains the length of the Field Values (Field-length) for each Field Name and an associated counter indicating how many instances the Field-length for a Field Name is present in the extracted query names. The Field-length table is analyzed to determine patterns of equal length in the “Results” table. Utilizing the Patterns table, unique combinations of the Field Values are generated as a filter candidate regular expression for DDoS attack mitigation purposes.