Pre-Resolved Blacklisted-Domain Filtering for Sinkhole Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intelligent attackers bypass traditional DNS sinkhole functionality, leading to ineffective blocking and detection of malicious traffic, and overload sinkhole servers with bandwidth-consuming attacks.
Innovation Solution
Implement security devices that proactively resolve network addresses for blacklisted domains, establish filters based on match criteria, and redirect or block malicious traffic to sinkhole servers, while setting DNS responses to zero TTL to identify and log suspicious devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS sinkhole functionality is used to redirect malicious traffic, then traffic redirection to sinkhole servers is achieved, but intelligent attackers can bypass this functionality and overload sinkhole servers with bandwidth-consuming attacks
Solution Approach 1:
The system proactively resolves network addresses for blacklisted domains before malicious traffic can reach the sinkhole server. By pre-resolving addresses and establishing filters based on match criteria, the system prevents attack traffic from overloading the sinkhole server while maintaining effective blocking of malicious domains
Solution Approach 2:
The system introduces an intermediary filtering mechanism that sits between the DNS requests and the sinkhole server. This intermediary evaluates DNS requests against blacklisted domains and source network address prefixes, redirecting only legitimate traffic to the sinkhole server while blocking malicious traffic before it reaches the server
2Quantity of substance
If DNS requests from all sources are redirected to sinkhole servers, then comprehensive malicious traffic capture is achieved, but sinkhole servers become overloaded with bandwidth-consuming attacks
Solution Approach 1:
The system applies different handling rules to different sources of DNS requests. By evaluating source network addresses against stored prefixes associated with possible attackers, the system selectively redirects only legitimate traffic to the sinkhole server while blocking traffic from identified attacker networks, thus capturing malicious traffic without overloading the server
3Device complexity
If blacklisted domains are blocked without proactive resolution, then simple DNS filtering is maintained, but attackers can bypass blocking and malicious content remains accessible
Solution Approach 1:
The system proactively resolves network addresses for blacklisted domains and stores them for future filtering. This preliminary resolution allows the system to effectively block malicious traffic by comparing DNS requests against pre-resolved blacklisted addresses, maintaining blocking reliability without requiring complex real-time resolution mechanisms
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network device obtains information, associated with blacklisted domains, that includes blacklisted domain identifiers, and sinkhole server identifiers associated with the blacklisted domain identifiers. The network device obtains a set of rules that specify match criteria, associated with the blacklisted domains, that include source network addresses and/or destination network addresses for comparison to packet source network addresses and/or packet destination network addresses associated with incoming packets. The set of rules specify actions to perform based on a result of comparing the match criteria and the packet source network addresses and/or the packet destination network addresses for the incoming packets. The network device receives packets, examines a packet source network address and/or a packet destination network address associated with the packets, compares the packet source network address and/or the packet destination network address to the match criteria, and performs an action based on a result of the comparison.