Passive DNS Classification for Detecting Hijacked Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting DNS hijacking is challenging due to its insidious nature and the difficulty in identifying malicious records among billions of DNS records, with traditional methods focusing on prevention rather than detection.
Innovation Solution
A system and method using passive DNS data and machine learning models to extract features from DNS records, combined with geolocation data, to classify potential DNS hijacking records, and implement post-filtering techniques to reduce false positives, leveraging simulated attacks for training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If passive DNS data is used to detect DNS hijacking, then detection capability is improved, but the difficulty of identifying malicious records among billions of DNS records increases
Solution Approach 1:
The patent segments the DNS record detection task by first filtering records based on domain characteristics (newly registered domains, domains with suspicious patterns) before performing full analysis. This divides the billions of records into smaller, more manageable subsets that are more likely to be malicious, making detection feasible without analyzing every record in detail
Solution Approach 2:
The system performs preliminary actions by pre-processing DNS records to extract features such as domain age, registration patterns, and historical DNS data before classification. This preliminary analysis prepares the data for more efficient machine learning classification, reducing the computational burden when analyzing the full dataset of billions of records
2Measurement precision
If machine learning models are used to classify DNS records, then detection accuracy is improved, but the complexity of the system increases
Solution Approach 1:
The patent introduces an intermediary layer of feature extraction and preprocessing that bridges the raw DNS data and the machine learning classifier. This intermediary component simplifies the input data into meaningful features (domain age, registration patterns, DNS history) that are easier for the classifier to process, reducing the overall system complexity while maintaining high accuracy
Solution Approach 2:
The system changes parameters by transforming raw DNS record data into standardized feature representations that capture essential characteristics. This parameter transformation simplifies the data structure and makes it more suitable for machine learning algorithms, reducing computational complexity while improving classification accuracy
3Difficulty of detecting and measuring
If feature extraction from DNS records is performed, then detection capability is improved, but the time required for analysis increases
Solution Approach 1:
The patent applies partial action by extracting only the most relevant features from DNS records rather than analyzing all possible attributes. The system focuses on key indicators such as domain registration date, historical DNS resolutions, and pattern matching, which provides sufficient detection capability without the time cost of comprehensive analysis of every record property
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting DNS hijacking records. The method includes (i) obtaining passive DNS (pDNS) data pertaining to a set of resource records, (ii) extracting a first set of features based at least in part on the pDNS data for a selected resource record, wherein the selected resource record is selected from the set of resource records, (iii) using a classifier to determine whether a candidate record corresponding to the selected resource record is a result of a DNS hijacking based at least in part on the first set of features, and (iv) performing an active measure in response to determining that the candidate record is the result of the DNS hijacking.