NXDOMAIN Query Detection for Claimable Domain Hijacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions fail to effectively protect against malicious software that exploits claimable non-existent domains, such as NXDOMAINs, which can be hijacked by attackers to intercept network traffic, leading to vulnerabilities like phishing, man-in-the-middle attacks, and domain takeovers.
Innovation Solution
Implement a network security device that monitors sessions for NXDOMAIN queries, performs high impact checks, claimability checks, internal resolvability checks, and registration checks to identify vulnerable domains, and takes actions such as blocking queries or alerting administrators to prevent hijacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions are used to filter network traffic, then basic firewall protection is provided, but they fail to detect and protect against claimable non-existent domains (NXDOMAINs) that can be hijacked by attackers
Solution Approach 1:
The patent performs preliminary checks on domains before they can be hijacked. When a domain query is detected, the system proactively checks whether the domain is claimable (can be registered by anyone) and non-existent (NXDOMAIN). If both conditions are true, the system takes preventive action by blocking the query or alerting administrators, thereby preventing potential hijacking before it can occur.
Solution Approach 2:
The patent introduces an intermediary security device positioned between the network traffic and the destination domains. This intermediary performs additional verification steps (claimability checks, NXDOMAIN verification) that go beyond traditional firewall rules. The intermediary acts as a mediator that filters out potentially dangerous domain queries before they reach their targets, adding a layer of protection without requiring changes to existing firewall infrastructure.
2Measurement precision
If traditional firewall rules are applied to filter traffic, then basic network security is maintained, but they cannot identify vulnerable claimable NXDOMAINs that pose security risks
Solution Approach 1:
The patent segments the domain detection process into distinct modular checks: (1) NXDOMAIN verification to confirm the domain does not exist, (2) claimability checks to determine if the domain can be registered by anyone, (3) vulnerability assessment to evaluate security risks. Each segment operates independently and can be implemented as separate security modules, allowing the system to achieve high detection precision while maintaining manageable complexity through modular design.
3Reliability
If no additional checks are performed on domain queries, then firewall operation remains simple and fast, but vulnerable claimable NXDOMAINs remain undetected and exploitable
Solution Approach 1:
The patent implements partial checking rather than exhaustive verification for all domain queries. The system selectively applies additional security checks (claimability and NXDOMAIN verification) only to queries that meet certain criteria or appear suspicious, rather than performing all possible checks on every single query. This approach maintains high security reliability for critical cases while preserving overall query processing speed and system productivity.
Data Source
AI summary
Techniques for detecting and protecting claimable non-existent domains are disclosed. A system, process, and/or computer program product for detecting and protecting claimable non-existent domains includes monitoring network activity using a network security device, detecting that a session is querying a claimable non-existent domain using a domain name system (DNS) security service, and performing an action in response to the session querying the claimable non-existent domain.