Domain Fronting Detection Through Passive-Active Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to detect domain fronting effectively, leading to increased false positives and negatives due to the resource-intensive nature of decrypting encrypted HTTPs sessions and the limitations of threat intelligence feeds, which fail to identify anomalous hosting providers supporting domain fronting.
Innovation Solution
A system that collects network data, identifies hosting providers, sends scans, receives result data, and generates enhanced threat intelligence feeds to detect and alert on domain fronting, utilizing passive and active scanning modules to identify suspicious activity and generate intelligent alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS security methods are used to detect domain fronting, then detection capability is maintained, but false positives and false negatives increase due to the inability to identify anomalous hosting providers
Solution Approach 1:
The system performs preliminary scanning of hosting providers to identify those that support domain fronting before actual attacks occur. By proactively mapping which hosting providers enable domain fronting, the system can pre-configure detection rules and blocking policies, eliminating the need to react to attacks after they occur and reducing false positives/negatives in the process.
Solution Approach 2:
The system introduces an intermediary layer of analysis by scanning and mapping hosting provider capabilities. This intermediary mapping layer connects domain names to their actual hosting infrastructure, enabling the system to detect domain fronting without requiring direct decryption of HTTPS sessions, thus improving detection accuracy while reducing false positives.
2Reliability
If every encrypted HTTPs session is decrypted to detect domain fronting, then detection capability improves, but resource consumption increases significantly
Solution Approach 1:
The system extracts the detection function from the HTTPS decryption process. Instead of decrypting every HTTPS session to detect domain fronting, the system separately scans and maps hosting provider capabilities, then uses this mapped information to detect domain fronting in network traffic. This extraction eliminates the resource-intensive decryption step while maintaining detection capability.
Solution Approach 2:
The system creates a copied or simplified model of the detection problem by pre-scanning and mapping hosting provider characteristics. This copied knowledge base of which providers support domain fronting allows the system to detect attacks using lightweight pattern matching against the pre-built map, rather than performing expensive real-time decryption and analysis of every HTTPS session.
3Productivity
If threat intelligence feeds are used for blocking and alerting, then security response is enabled, but the system fails to identify anomalous hosting providers supporting domain fronting
Solution Approach 1:
The system performs preliminary scanning of hosting providers to build a knowledge base of which providers support domain fronting. This pre-built intelligence is then used to enhance threat detection and response, enabling the system to reliably identify anomalous activity and improve security response by focusing on actual threats rather than reacting to false indicators.
Solution Approach 2:
The system establishes a feedback loop where scanning results about hosting provider capabilities are fed back into the threat intelligence feeds. This feedback mechanism continuously updates the system's understanding of which providers are susceptible to domain fronting, improving the reliability of anomaly detection and enabling more accurate security responses over time.
Data Source
AI summary
This disclosure describes techniques and mechanisms for improving blocking and alerting with domain fronting intelligence. The techniques may identify Internet infrastructure that supports domain fronting through passive data collection and active scanning of the data. The results of the active scanning are then used to generate enhanced threat intelligence feeds that associate indicators of compromise with their support of domain fronting. The new feeds are then used to perform more aggressive blocking, raise weak alerts that can be correlated to other alerts, and to create a more secure DNS system by de-prioritizing infrastructure that supports domain fronting for DNS responses.