FQDN Identification via IP Correlation Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining fully qualified domain names (FQDNs) are hindered when DNS queries and server name indication (SNI) information from HTTPS handshakes are encrypted, making it impossible for service providers to identify accessed FQDNs by intercepting and inspecting DNS traffic.
Innovation Solution
A method and apparatus that utilize IP address tracking to determine FQDNs by building a correlation model based on IP addresses, resource IPs, and load timings, allowing for the mapping of FQDNs to IP addresses and resource IPs, even in cases where many FQDNs share the same IP address, using statistical or machine learning models to identify the closest fit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS queries and SNI information are encrypted to protect network traffic, then security and privacy are improved, but the ability to intercept and inspect DNS traffic for FQDN identification is lost
Solution Approach 1:
The patent introduces IP address tracking as an intermediary method to indirectly identify FQDNs. Instead of directly inspecting encrypted DNS traffic or SNI information, the system uses IP addresses, resource IPs, and load timings as intermediate indicators that can be observed in network traffic, thereby resolving the contradiction between encryption-based security and FQDN detectability
Solution Approach 2:
The patent replaces the traditional mechanical approach of directly inspecting DNS queries and SNI fields with a statistical/machine learning-based system that infers FQDNs from IP address patterns and timing data, allowing FQDN identification without compromising the encrypted network traffic
2Productivity
If multiple FQDNs share the same IP address, then network efficiency is improved, but the precision of FQDN identification is reduced
Solution Approach 1:
The patent segments the identification process into multiple stages: first tracking IP addresses and resource IPs separately, then using load timings to distinguish between different FQDNs that share the same IP. This segmentation allows the system to maintain network efficiency while achieving precise FQDN identification through temporal differentiation
Solution Approach 2:
The patent adds the time dimension through load timing data to the traditional IP address-based identification system. By incorporating temporal information about when resources are loaded, the system can disambiguate between multiple FQDNs that map to the same IP address, thereby improving identification precision without sacrificing network efficiency
Data Source
AI summary
Fully qualified domain name determination is disclosed. A queue of fully qualified domain names (FQDN) is created using a predetermined amount of network domains. Each FQDN is crawled from a plurality of collection agents of a computer network. For each FQDN, data comprising an Internet Protocol (IP) address of the FQDN, IP addresses for resources loaded for the FQDN and load times of the resources loaded for the FQDN are extracted. A correlation model is generated based on the data. An FQDN being accessed by one or more computer devices of the computer network is determined by using the correlation model.