Network Detector for Name Resolution Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In datacenters, compromised virtual machines (VMs) can exploit name resolution protocols like LLMNR and NBT-NS to intercept authentication information, and existing methods lack effective automated detection and remediation mechanisms.
Innovation Solution
An analysis appliance is deployed to detect compromised data compute nodes (DCNs) by analyzing name resolution responses, using a data flow collection system and anomaly detection engines to identify suspicious behavior and initiate remediation actions such as quarantine or firewall rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If name resolution protocols (LLMNR, NBT-NS) are used as alternate protocols for host identification, then DNS resolution capability is improved, but security vulnerability increases due to exploitation by compromised VMs
Solution Approach 1:
The patent introduces a network detector as an intermediary component that monitors name resolution traffic between VMs. The detector analyzes response packets to identify compromised VMs that provide incorrect IP addresses, thereby mediating between the need for name resolution functionality and the security risk of exploitation.
Solution Approach 2:
The system implements feedback mechanisms where the network detector continuously monitors name resolution responses and provides real-time security assessments. When compromised VMs are detected, the system can trigger remediation actions such as isolating the affected VMs, creating a feedback loop that maintains security while preserving protocol functionality.
2Measurement precision
If automated detection and remediation mechanisms are implemented, then security threat detection capability is improved, but system complexity increases
Solution Approach 1:
The network detector is designed as a multi-functional component that performs multiple security analysis tasks within a single system. It can detect various types of name resolution exploits, analyze different protocol types (LLMNR, NBT-NS), and implement multiple remediation strategies, thereby reducing overall system complexity through consolidation.
Solution Approach 2:
The detection system is segmented into distinct functional modules: packet capture components, analysis engines that evaluate response packets, and remediation modules. This segmentation allows each component to specialize in specific tasks, improving detection precision while managing complexity through modular architecture.
Data Source
AI summary
Some embodiments provide a method for identifying security threats to a datacenter. The method receives flow attribute sets for multiple flows from multiple host computers in the datacenter on which data compute nodes (DCNs) execute. Each flow attribute set indicates at least a source DCN for the flow. The method identifies flow attribute sets that correspond to DCNs responding to name resolution requests. For each DCN of a set of DCNs executing on the host computers, the method determines whether the DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the DCN based on the identified flow attribute sets. When a particular DCN has sent responses to name resolution requests in a manner that deviates from a historical baseline for the particular DCN, the method identifies the particular DCN as a security threat to the datacenter.