DNS based enforcement for confinement and detection of network malicious activities
View Patent ↗Malicious network activities do not make use of the Domain Name System (DNS) protocol to reach remote targets outside a local network. This DNS-based enforcement system for confinement and detection of network malicious activities requires that every connection toward a resource located outside the local network is blocked by default by the local enforcement box, e.g. a firewall or a proxy. Outbound connections are allowed to leave the local network only when authorized directly by an entity called the DNS Gatekeeper.
1. A system for detection and confinement of network malicious activities originating from a local host on a local network to a remote host outside of said local network, comprising:
a local domain name system (DNS) server connected to said local network, configured to:
receive from said local host a request for an outbound connection to said remote host,
complete a DNS lookup to obtain an IP address of said remote host, and
generate a conformity indication when said request for said outbound connection refers to a legitimate connection;
a DNS policy repository configured to enable select requests from the local host to access specified remote resources without the DNS lookup;
a DNS gatekeeper to generate a connection authorization indication based on said conformity indication; and
a local enforcement unit connected between said local network and the remote host configured to block-establishment of said outbound connection by default, until it receives said connection authorization indication.
2. The system of claim 1 ,
wherein the DNS policy repository includes a list of specified exceptions, including at least local hosts allowed to access specified remote resources without the DNS lookup.
3. The system of claim 2 , wherein said specified exceptions further include at least:
connections carrying peer-to-peer traffic;
connections from a local host with an embedded IP address; and
remote administration tools.
4. The system of claim 1 , wherein said local enforcement unit comprises:
a controlling unit configured to:
block said connection until receipt of said connection authorization indication, and
finally reject said request in the absence of said connection authorization indication;
a connection monitoring unit configured to:
determine if said outbound connection is a legitimate connection, and
instruct said control unit to enable said outbound connection in the absence of said connection authorization indication when said outbound connection is a legitimate connection.
5. The system of claim 4 , wherein said outbound connection is a legitimate connection when said local host hosts legitimately uses a numeric IP address.
6. The system of claim 4 , wherein said controlling unit, to allow or block said outbound connection, controls a standard firewall configured to protect against non-authorized users.
7. The system of claim 1 , wherein said outbound connection is a legitimate connection when said local host transmits a web page to a remote server.
8. The system of claim 1 , wherein said local enforcement unit further comprises:
a proxy server configured to:
block said outbound connection, and
unblock said outbound connection when said outbound connection carries a valid domain name request based on said conformity indication; and
an alarm reporting unit to rise an alarm when said request is finally blocked by said controlling unit, wherein said proxy server allows said outbound connection when said domain name is valid.
9. The system of claim 1 further comprising:
means for:
logging blocked outbound connections, and
reporting all local hosts that requested the respective blocked connections.
10. A method for detection and confinement of network malicious activities originating from a local host on a local network to a remote host outside of said local network, comprising:
generating a conformity indication in response to a completed DNS lookup performed by a local domain name system (DNS) server connected to said local network in response to a request received from said local host for an outbound connection to said remote host, with a view to obtain an IP address of said remote host, wherein said conformity indication indicates that said request for said outbound connection refers to a legitimate connection;
generating a connection authorization indication using an enforcement unit based on said conformity indication and a list of specified exceptions, said list including at least local hosts allowed to access specified remote resources without the DNS lookup; and
blocking establishment of said outbound connection by default until receipt of said connection authorization indication.
11. The method of claim 10 , further comprising:
monitoring the connection establishment process for said outbound connection to determine if said outbound connection is a legitimate connection; and
establishing said outbound connection in the absence of said connection authorization indication when said outbound connection is a legitimate connection.
12. The method of claim 11 , wherein said outbound connection is a legitimate connection when said local host transmits a web page to a remote server.
13. The method of claim 12 , wherein said monitoring step comprises:
identifying an acknowledgement message received by said local host from said remote host after an exchange of SYN messages;
accessing the message in a first payload packet transmitted by said local host after receipt of said acknowledgement message; and
flagging said connection as a legitimate connection when the message in said first payload packet is a HTTP GET command.
14. The method of claim 13 , further comprising:
sending a TCP RESET message to said remote host to terminate said connection establishment process when the message in said first payload packet is not a HTTP GET command.
15. The method of claim 13 , further comprising:
monitoring said outbound connection once established to determine when the response to said HTTP GET command indicates that said remote host is web server.
16. The method of claim 10 , further comprising:
dividing said local network into cells; and
equipping each cell with a respective local DNS server and an enforcement unit to confine spreading of a malicious activity within a cell.
17. The method of claim 10 , further comprising:
finally blocking establishment of said outbound connection in the absence of said connection authorization indication; and
raising an alarm whenever said request is finally blocked.
18. The method of claim 17 further comprising:
logging all finally-blocked outbound connections; and
reporting all local hosts that requested the respective blocked connections.
19. The method of claim 10 , wherein said specified exceptions include:
at least connections carrying peer-to-peer traffic,
remote administration tools, and
connections from a local host with an embedded IP address.