Parallel Domain Detection Using Shared Bloom Filter
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face computational intensity in efficiently detecting newly observed domains, which are potentially malicious, as they require tracking a large volume of newly registered domain names in real-time to prevent network abuses such as denial of service attacks and phishing.
Innovation Solution
A system utilizing multiple processors that share a common Bloom filter to quickly identify newly observed domain name records by generating and comparing keys, allowing for parallel processing and scalability, thereby speeding up the detection of new domain records.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single processor tracks newly observed domains sequentially, then detection accuracy is maintained, but processing speed and productivity deteriorate due to computational intensity
Solution Approach 1:
The patent divides the domain detection task into multiple independent processor units, each capable of autonomously tracking newly observed domains. The Bloom filter is segmented into multiple zones that can be processed in parallel, allowing simultaneous domain detection across multiple processors without requiring sequential processing, thereby increasing productivity while distributing computational load.
Solution Approach 2:
The patent introduces parallel processing as a new dimension for domain detection by utilizing multiple processors operating simultaneously. This transforms the single-threaded sequential detection approach into a multi-threaded parallel architecture, adding temporal and spatial dimensions to the detection process, which significantly improves processing speed and reduces computational intensity per processor.
2Productivity
If multiple processors are used for parallel detection, then processing speed improves, but system complexity increases due to filter management
Solution Approach 1:
The patent merges multiple Bloom filters into a single shared filter structure that is accessed by all processors. This unified filter management approach eliminates the complexity of coordinating multiple independent filters, as processors can independently query and update the shared filter without requiring complex synchronization protocols, thus maintaining low system complexity while achieving high parallel throughput.
Solution Approach 2:
The shared Bloom filter serves multiple functions simultaneously: it acts as a common data structure for all processors, provides automatic deduplication across parallel processing streams, and enables inter-processor communication without additional overhead. This multi-functional design simplifies the overall system architecture while maximizing detection throughput.
3Measurement precision
If Bloom filter size is increased to reduce false positives, then measurement precision improves, but memory usage and processing overhead increase
Solution Approach 1:
The patent segments the large Bloom filter into multiple smaller zones or partitions that can be independently managed. Each processor can work with a subset of the total filter space, reducing the memory footprint required per processor while maintaining the overall precision of the complete filter structure. This segmentation allows the system to achieve high detection accuracy without requiring each processor to allocate excessive memory resources.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an embodiment, a computer-implemented method detects updates to a domain name system record system. In the method, a stream of data points is received with each data point describing a record of a domain name system. For respective data points, a processor is selected from a plurality of processors. The processors are each configured to apply a data point against a common filter that assesses whether the data point is in a set. At the selected processor, the respective data point is applied to the common filter to determine whether the record is included in the set. When the record is determined not to be included in the set, a message is provided to indicate that the domain name system includes a new record, and the common filter is updated to include the data point in the set.