NAT Router Compromised Device Detection via DNS Cache Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Servers face challenges in identifying and addressing suspicious requests from devices behind Network Address Translation (NAT) routers, as the identity of these devices is hidden, making it difficult to inform users of potential malicious activity.
Innovation Solution
A system and method where a server can determine if a request from a device behind a NAT router is suspicious by comparing local DNS cache information with a list of known malicious domains, and instructs the device to execute processes for malware detection and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server monitors requests from devices behind NAT router, then network security is improved, but the ability to identify and inform users of compromised devices is worsened due to hidden device identities
Solution Approach 1:
The patent introduces an intermediary process that acts as a bridge between the server and devices behind the NAT router. This process receives notifications from the server about suspicious requests, translates the server's external IP address into local device identifiers, and delivers the information to the appropriate device. This intermediary mechanism resolves the contradiction by enabling information flow without requiring direct server-to-device communication, thus preserving network security while recovering lost device identity information.
2Measurement precision
If the server sends notifications to all devices behind NAT router, then compromised devices can be identified, but network traffic and processing overhead increase
Solution Approach 1:
The patent extracts and utilizes the Network Address Translation (NAT) mapping information that already exists in the router to avoid sending notifications to all devices. By querying the NAT mapping table, the system extracts only the specific local device identifier associated with the external IP address that sent the suspicious request. This extraction approach maintains precise compromised device identification while minimizing network traffic by avoiding blanket notifications to all devices.
3Measurement precision
If DNS cache comparison is performed on each device, then malware detection accuracy is improved, but device computational resources and time are consumed
Solution Approach 1:
The patent implements preliminary action by having devices periodically perform DNS cache comparisons with known malicious domain lists and store the results before actual malware detection is needed. When a suspicious request is detected, the system can immediately query these pre-computed results rather than performing time-consuming real-time analysis. This preliminary preparation maintains high malware detection accuracy while significantly reducing the time required for actual detection and response.
Data Source
AI summary
Methods and systems are described whereby a server can forward a request from a device behind a NAT router to a system to determine if the request is suspicious. A server can receive a message via a network device, such as a NAT router, disposed at a location. The message can originate from one of a plurality of computing devices located downstream of the network device. The server can determine that the message originated from a compromised device and transmit a signal to facilitate execution of a first process on the computing devices located downstream from the compromised device, wherein, upon execution, the first process is configured to compare information located in a local storage of the computing device with a predetermined list of domains.