Proxy Server Malware Detection via DNS Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In proxy server networks, identifying and detecting malware-infected client devices is challenging due to ambiguity in determining the originating computer, especially when they communicate through a proxy server, which can mask anomalous behavior and exploit existing security mechanisms.
Innovation Solution
The system passively monitors proxy connection requests and performs independent DNS queries to associate DNS messages with client devices, enabling the detection of anomalous behavior and potential malware infections by correlating DNS traffic without altering existing proxy server configurations or decrypting encrypted HTTP/HTTPS traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proxy servers are used to communicate with external networks, then network security is improved by masking client identities, but malware detection capability deteriorates due to ambiguity in identifying infected devices
Solution Approach 1:
The patent introduces an intermediary system that sits between the proxy server and the security monitoring infrastructure. This intermediary captures proxy connection requests, extracts client device identifiers, and correlates them with DNS query patterns. By acting as a mediator, it enables malware detection while preserving the proxy server's identity-masking function, thus resolving the contradiction between network security and malware detection capability
Solution Approach 2:
The system implements feedback loops where DNS query responses are correlated back to the original client devices through proxy connection request analysis. This feedback mechanism allows the system to trace anomalous DNS behavior back to specific clients even when communicating through proxies, thereby maintaining malware detection capability while using proxy servers for network security
2Ease of manufacture
If static identifiers and blacklisting methods are used for malware detection, then implementation simplicity is improved, but detection effectiveness deteriorates due to proxy server masking
Solution Approach 1:
The patent replaces traditional mechanical blacklisting methods with a dynamic correlation-based detection system. Instead of relying on static identifier matching that fails with proxy masking, the system substitutes a mechanism that correlates proxy connection requests with DNS query patterns over time. This substitution maintains implementation feasibility while dramatically improving detection effectiveness in proxy environments
3Difficulty of detecting and measuring
If encrypted HTTP/HTTPS traffic is monitored for malware detection, then detection capability is improved, but system complexity increases due to decryption requirements
Solution Approach 1:
The patent extracts malware detection capability from the encrypted traffic payload itself and relocates it to the unencrypted metadata layer. By extracting client device identifiers from proxy connection requests and correlating them with DNS query patterns, the system achieves malware detection without needing to decrypt HTTP/HTTPS traffic. This extraction approach maintains high detection capability while avoiding the complexity of decryption infrastructure
Data Source
AI summary
This specification generally relates to methods and systems for applying network policies to devices based on their current access network. One example method includes identifying a proxy connection request sent from a particular client device to a proxy server over a network, the proxy connection request including a hostname and configured to direct the proxy server to establish communication with the computer identified by the hostname on behalf of the client device; determining an identity of the client device based on the proxy connection request; identifying a domain name system (DNS) response to a DNS request including the hostname from the proxy connection request; and updating DNS usage information for the particular client based on the identified DNS response including the hostname from the proxy connection request.