Host-Level Malicious DNS Activity Detection via PID Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) protocol lacks effective security measures, making it vulnerable to attacks such as DNS hijacking, Command and Control communication, and DNS cache poisoning, which existing solutions fail to detect at a host level, especially in heterogeneous network environments with different Operating Systems.
Innovation Solution
A host-level detection system is implemented using DNS resolver agents that record DNS queries and responses, associate them with Program Identifiers (PIDs), and report to a backend server for machine learning-based detection of malicious activities, employing OS-specific methods to capture and process DNS activities across multiple end-hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If DNS protocol is used for name resolution, then network communication is enabled, but security vulnerabilities to attacks are introduced
Solution Approach 1:
The patent introduces a backend server as an intermediary that receives, analyzes, and validates DNS queries and responses before they reach the resolver. This mediator layer filters malicious traffic while allowing legitimate DNS operations to proceed, thus maintaining ease of operation while blocking security threats.
Solution Approach 2:
The system implements feedback mechanisms where the backend server continuously monitors DNS activities, learns from patterns of malicious behavior, and adjusts detection rules accordingly. This feedback loop enables the system to adapt to new attack vectors while maintaining reliable DNS functionality.
2Measurement precision
If host level detection is implemented, then detection precision is improved, but device complexity increases
Solution Approach 1:
The detection system is segmented into distinct components: DNS resolver agents running on individual hosts that collect data, and a centralized backend server that performs analysis. This segmentation allows precise host-level detection while distributing system complexity across multiple manageable parts rather than concentrating it in one complex unit.
Solution Approach 2:
The backend server acts as an intermediary that handles the complex analysis tasks, receiving simplified data from resolver agents and returning detection results. This mediator approach enables high detection precision without requiring each individual host to implement complex detection logic locally.
3Reliability
If DNS traffic is monitored and recorded, then detection coverage is improved, but loss of time increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and storing DNS query and response data in structured formats as they occur. This preliminary organization of data during normal operations enables rapid analysis and detection when needed, improving detection coverage without significant time loss during actual security events.
Solution Approach 2:
The patent replaces manual or mechanical analysis methods with automated machine learning-based detection systems. This substitution enables the system to process and analyze large volumes of DNS traffic efficiently, improving detection coverage while minimizing the time required for analysis through automated pattern recognition.
Data Source
AI summary
A system and computer-implemented method are provided for host level detection of malicious Domain Name System (DNS) activities in a network environment having multiple end-hosts. The system includes a set of DNS resolver agents configured to (i) gather DNS activities from each of the multiple end-hosts by recording DNS queries and DNS responses corresponding to the DNS queries, and (ii) associate the DNS activities with Program Identifiers (PIDs) that identify programs that issued the DNS queries. The system further includes a backend server configured to detect one or more of the malicious DNS activities based on the gathered DNS activities and the PIDs.