Real-Time DNS Threat Detection Through Graph-Based Asset Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing sophistication of malicious actors in compromising the trustworthiness of Domain Name System (DNS) servers and communication channels poses a significant threat to the security and integrity of internet communications, risking the exposure of sensitive information.
Innovation Solution
A system that employs graph-theoretic methods and machine learning techniques to analyze network traffic data, generating a graph data structure to detect potentially compromised DNS servers and machines, assigning risk scores to nodes, and classifying them as suspicious or trustworthy based on the graph's structure, thereby identifying and mitigating security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS security assumptions (trustworthy servers and secure communication channels) are maintained, then DNS service operation is simple and efficient, but security against sophisticated malicious actors is compromised
Solution Approach 1:
The system performs preliminary actions by constructing a graph data structure from DNS query logs before security assessment. Nodes representing DNS servers and target machines are pre-populated with relationship data, enabling proactive security evaluation rather than reactive response to attacks
Solution Approach 2:
The patent introduces an intermediary graph-based analysis system between the DNS infrastructure and security assessment. This intermediary layer processes DNS query logs through graph construction and random walk algorithms to generate security scores, acting as a mediator that translates raw DNS data into actionable security intelligence without disrupting core DNS operations
2Measurement precision
If graph-theoretic methods and machine learning techniques are employed to analyze network traffic data, then detection precision of compromised DNS servers improves, but system complexity increases
Solution Approach 1:
The patent replaces traditional mechanical security verification methods with graph-theoretic analysis and machine learning algorithms. Instead of rule-based or signature-based detection, the system uses random walk algorithms on graph data structures to compute security scores, substituting complex computational methods for simpler but less accurate traditional approaches
Solution Approach 2:
The system changes parameters by transforming static DNS log data into dynamic graph structures with multiple attributes. Nodes in the graph contain rich information including DNS server identifiers, target machine identifiers, query timestamps, and security scores derived from random walk algorithms, enabling multi-dimensional analysis that adapts to varying threat landscapes
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure is directed towards the real-time detection and mitigation of security threats to a domain name system (DNS) for a communication network. A graph-theoretic method is applied to detect compromised DNS assets (e.g., DNS servers and web servers that DNS servers map domain names to). A graph is generated from domain name resolution (DNR) transactions. The nodes of the graph represent the DNS assets and edges between the nodes represent the DNR transactions. The graph is analyzed to detect features that signal compromised assets. The detection of such features serves to act as a binary classifier for the represented assets. The binary classifier acts to classify each node as non-compromised or compromised. The analysis is guided by supervised and/or unsupervised machine learning methods. Once the assets are classified, DNR transactions are analyzed in real-time. If the transaction involves a compromised asset, an intervention is performed that mitigates the threat.