DNS Subnet Diversity Analysis for Botnet Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security mechanisms are ineffective in detecting botnets that utilize fast flux techniques, such as single-flux and double-flux, which obscure malicious website IP addresses by constantly changing DNS records, making it difficult to identify and prevent malware distribution and attacks.
Innovation Solution
Implementing a system that analyzes DNS information to determine the number of unique subnets associated with a domain name, exceeding thresholds to identify suspicious or malicious activity, and intercepting DNS packets to prevent communication with botnet-controlled domains, using sensors deployed across the network to share and analyze DNS data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If fast flux techniques are used to constantly change DNS records, then the malicious website's IP address is obscured and detection becomes harder, but network security mechanisms become less effective in identifying and blocking malware distribution
Solution Approach 1:
The system performs preliminary analysis of DNS records by examining the temporal distribution and subnet diversity of IP addresses before a security incident occurs. By pre-calculating and storing subnet information for each domain, the system is ready to quickly identify fast flux patterns when monitoring for suspicious activity, enabling proactive rather than reactive security responses.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the DNS system and security blocking mechanisms. This intermediary component analyzes DNS records to determine subnet diversity and temporal distribution patterns, acting as a mediator that translates raw DNS data into actionable security intelligence. This intermediary layer enables security mechanisms to effectively detect and block fast flux botnets without being directly coupled to the DNS infrastructure.
2Adaptability or versatility
If multiple IP addresses are associated with a single domain name through fast flux, then the botnet becomes more resilient to detection and takedowns, but it becomes more difficult to identify the attacker's network
Solution Approach 1:
The patent segments the analysis of DNS records by examining each IP address's subnet information individually. By dividing the domain's IP address list into discrete subnet components and analyzing their temporal distribution patterns, the system can identify coordinated fast flux behavior across multiple subnets. This segmentation approach transforms the complex problem of detecting distributed botnet activity into manageable analysis of individual subnet contributions.
Solution Approach 2:
The patent adds a temporal dimension to the analysis of IP address distribution. Instead of merely counting the number of unique subnets, the system analyzes when each subnet's IP addresses appear in DNS records over time. This temporal analysis reveals patterns characteristic of fast flux botnets, such as coordinated registration and deregistration cycles, providing an additional dimension for detection that complements spatial subnet analysis.
3Ease of manufacture
If traditional IP address-based access control lists are used, then simple malicious IPs can be blocked, but they become ineffective against botnets that frequently change IP addresses
Solution Approach 1:
The patent creates a universal detection framework that works across multiple botnet configurations and fast flux techniques. By analyzing fundamental patterns in DNS record temporal distribution and subnet diversity, the system provides a multi-functional solution that detects various types of malicious activity including fast flux, botnet command-and-control communications, and coordinated DNS manipulation. This universal approach replaces the need for multiple specialized blocking mechanisms.
Solution Approach 2:
The patent changes the detection parameters from static IP address matching to dynamic analysis of DNS record temporal distribution patterns. Instead of relying on fixed IP addresses in access control lists, the system monitors how IP addresses associated with domains change over time and from which subnets they originate. This parameter change enables detection of fast flux botnets that constantly modify their IP address assignments, making the security mechanism adaptable to evolving threats.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is disclosed for distributed detection of botnets via a plurality of sensors on a network. According to embodiments, DNS information, including domain names and addresses, is received at a sensor, the number of unique subnets corresponding to a domain name is determined and an alert is sent to other sensors when the number of unique subnets exceeds a first threshold. Other embodiments are also disclosed.