Threat Intelligence Seeding for Rapid Recursive DNS Cache Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Populating a DNS cache for a restarted or new recursive DNS server is a time-consuming and resource-intensive process, leading to significant performance degradation.
Innovation Solution
A method and system that utilizes a threat intelligence system to passively or actively capture DNS data, which is then used to seed the DNS cache of a recursive DNS server, applying filters based on geographic location, time-to-live, and popularity to ensure rapid cache population.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a recursive DNS server is restarted or newly initialized, then the DNS cache is empty and the server must rebuild it through standard resolution processes, but this process is time-consuming and resource-intensive, leading to performance degradation
Solution Approach 1:
The patent applies preliminary action by pre-populating the DNS cache with query-answer pairs from threat intelligence data before the recursive DNS server begins normal operation. When a DNS server is restarted or newly initialized, the system proactively fills the cache with previously observed DNS query results from the threat intelligence system, so that the server is ready to handle queries immediately without undergoing the slow standard cache-building process.
2Reliability
If the DNS cache is populated using standard resolution processes, then the cache will eventually contain necessary data, but the process consumes excessive computational resources and time during server initialization
Solution Approach 1:
The patent applies copying by replicating DNS query-answer pairs from the threat intelligence system's stored data into the recursive DNS server's cache. Instead of performing expensive real-time DNS resolution to build the cache, the system copies previously resolved DNS data that has already been validated and stored by the threat intelligence system, significantly reducing computational resource consumption while ensuring cache data availability.
3Speed
If the recursive DNS server processes queries without a populated cache, then it can maintain operational simplicity, but the query resolution speed is significantly reduced
Solution Approach 1:
The patent introduces an intermediary mechanism between the threat intelligence system and the recursive DNS server. The threat intelligence system acts as a mediator that provides pre-resolved DNS data to the recursive server's cache. This intermediary approach enables fast query resolution by supplying ready-made answer data, while the complexity of cache population is handled by the threat intelligence system rather than the recursive DNS server itself.
Data Source
AI summary
The present application describes systems and methods for populating a DNS cache of a recursive DNS server using information gathered by a threat intelligence system. The threat intelligence system may collect some or all DNS responses from one or more recursive DNS servers as the one or more DNS servers process various received requests. Since the threat intelligence engine has access to this DNS data, the DNS data may be used to seed a DNS cache of a recursive DNS server.