System and method for suppressing DNS requests
A virtual private router (VPR) intercepts DNS requests and returns a pseudo IP address to the requesting application and the pseudo IP address is mapped to a domain name in the request. Requests for content including the pseudo IP address are modified to include the corresponding domain name and transmitted to an intermediary server, which resolves the domain name to a real IP address and forwards the content request. The content is received by the intermediary server, which returns it to the requesting application, such as by way of the VPR. Real IP addresses may be returned by the intermediary server such that subsequent content requests to the domain name may bypass the intermediary server. Content requests may be sent to the intermediary server, which may instruct the VPR to bypass the server when bypass is needed.
1. A method comprising:
receiving, by a first server, a plurality of requests, each request of the plurality of requests including a domain name and being received from a source; and
for each request of the plurality of requests:
obtaining, by a module on the first server, a selected option for processing the each request from a group of options by evaluating whether the domain name is associated with increased at least one of security and privacy risk according to a reputation score associated with the domain name in a threat database; and
when the reputation score associated with the domain name is below a predefined threshold and is not associated with a low probability of false alarm, selecting as the selected option (a) retrieving content referenced by the each request by the first server by:
resolving, by the first server, the domain name of the each request to a first routable internet protocol (IP) address;
retrieving, by the first server, the content referenced by the each request from a second server corresponding to the first routable IP address;
returning, by the first server to the source of the each request, the content referenced by the each request to a source of the each request;
when the reputation score associated with the domain name is above the predefined threshold, selecting as the selected option (b) retrieving the content referenced by the each request in bypass of the first server by:
resolving, by the first server, the domain name of the each request to the first routable IP address;
returning, by the first server to the source of the each request, a bypass response indicating that the source of the each request should send a second content request to the first routable IP address in bypass of the first server to retrieve the content referenced by the each request; and
when the reputation score associated with the domain name is below the predefined threshold and is associated with the low probability of the false alarm, selecting as the selected option (c) blocking the each request instead of retrieving the content referenced by the each request.
2. The method of claim 1 , further comprising, when the selected option is (b), in response to receiving the bypass response from the first server:
obtaining, by a module executing on the source of the each request, a second routable internet protocol (IP) address associated with the domain name,
sending, by the module executing on the source of the each request, a second request for the content referenced by the each request to a server corresponding to the second IP address, the second request being sent in bypass of the first server; and
receiving, by the module executing on the source of the each request, the content referenced by the each request in bypass of the first server.
3. The method of claim 2 , wherein obtaining the second IP address comprises issuing a domain name service (DNS) request including the domain name to a DNS server over a computer network, the DNS request being issued from the source of the each request after receiving the bypass response.
4. The method of claim 1 , further comprising requesting, by a module executing on the source of the each request, the content referenced by the each request from the first routable IP address.
5. The method of claim 1 , further comprising:
intercepting, from an application executing on the source of the each request by a module executing on the source of the each request, a request to resolve the domain name;
returning, by the module executing on the source of the each request, a first pseudo IP address without issuing a domain resolution request over a computer network;
intercepting, from the application executing on the source of the each request by a module executing on the source of the each request, an original content request including the first pseudo IP address;
generating, by the module executing on the source of the each request, the each request including the first domain name; and
and sending the each request to the first server.
6. The method of claim 1 , where the first server is at least one of a proxy server and a virtual private network (VPN) server.
7. A system comprising one or more processing devices and one or more memory devices operably couple to the one or more processing devices, the one or more memory devices storing executable code effective to cause the one or more processing devices to:
receive a content request including a domain name and received from a source;
obtain, by a module, a selected option for processing the content request from a group of options according to a reputation score associated with the domain name in a threat database, the module programmed to:
select option (a) as the selected option when the reputation score associated with the domain name is below a predefined threshold and is not associated with a low probability of false alarm;
select option (b) as the selected option when the reputation score associated with the domain name is above the predefined threshold; and
select option (c) as the selected option when the reputation score associated with the domain name is below the predefined threshold and is associated with the low probability of the false alarm;
when the selected option is option (a) retrieving content referenced by the content request by the system:
resolve the domain name of the content request to a first routable internet protocol (IP) address;
retrieve the content referenced by the content request from a second server corresponding to the first routable IP address; and
return, to the source of the content request, the content referenced by the content request;
when the selected option is option (b) retrieving the content referenced by the content request in bypass of the system:
resolve the domain name of the content request to the first routable IP address;
return to the source of the content request, a bypass response indicating that the source of the content request should send a second content request to the first routable IP address in bypass of the system to retrieve the content referenced by the content request; and
when the selected option is option (c) block the content request instead of retrieving the content referenced by the content request.