Methods and systems for prevention of attacks associated with the domain name system
The attack vectors for some denial-of-service cyber attacks on the Internet's Domain Name System (DNS) are bad, bogus, or unregistered domain name DNS requests to resolve domain names that are not registered in the DNS. Some other cyber attacks steal sensitive data by encoding the data in bogus domain names, or domain names otherwise not registered in the DNS, that are transferred across networks in bogus DNS requests. A DNS gatekeeper may filter in-transit packets containing DNS requests and may efficiently determine if a request's domain name is registered in the DNS. When the domain name is not registered in the DNS, the DNS gatekeeper may take one of a plurality of protective actions. The DNS gatekeeper drops requests determined not to be legitimate, which may prevent an attack.
1. A method comprising:
storing, by a gatekeeper, a probabilistic data structure representing a subset of a plurality of domain names in a Domain Name System (DNS), wherein the probabilistic data structure representing the subset of the plurality of domain names in the DNS is selected from a plurality of probabilistic data structures representing a plurality of subsets of the plurality of domain names in the DNS based on false positive rates associated with the plurality of probabilistic data structures;
receiving, by the gatekeeper, a plurality of packets;
determining, based on packet information, whether each respective packet of the plurality of packets comprises a domain name;
based on a determination that a first packet of the plurality of packets comprises a first domain name, testing, without querying the DNS, the probabilistic data structure to determine if the first domain name is registered in the DNS; and
based on a determination that the first domain name is not registered in the DNS:
determining, based on at least one criteria, a legitimacy of the first packet; and
based on the legitimacy, dropping the first packet.
2. The method of claim 1 , further comprising:
based on the determination that the first domain name is not registered in the DNS, transmitting data regarding the first packet to a management server.
3. The method of claim 1 , further comprising:
based on a determination that a second packet of the plurality of packets does not comprise a domain name, transmitting the second packet towards its intended destination.
4. The method of claim 1 , further comprising:
testing, without querying the DNS, the probabilistic data structure to determine if a second domain name of a second packet is represented in the probabilistic data structure;
based on a determination that the second domain name is not represented in the probabilistic data structure, determining whether the second packet is legitimate; and
based on a determination that the second packet is legitimate, transmitting the second packet towards its intended destination.
5. The method of claim 4 , further comprising:
monitoring network traffic for a response to the second packet;
based on the response to the second packet, inserting the second domain name into the probabilistic data structure; and
transmitting the second domain name to a management server.
6. The method of claim 1 , wherein determining the legitimacy of the first packet comprises:
determining a rate of received invalid DNS query requests associated with the first domain name;
determining whether the rate of received invalid DNS query requests satisfies a threshold; and
based on a determination that the rate of received invalid DNS query requests satisfies the threshold, determining the legitimacy of the first packet.
7. The method of claim 1 , wherein determining the legitimacy of the first packet comprises:
determining whether a country code is associated with the first domain name;
determining whether the country code indicates a lag; and
based on a determination that the country code does not indicate the lag, determining the legitimacy of the first packet.
8. The method of claim 1 , wherein the probabilistic data structure is one of:
a Bloom filter; or
a Cuckoo filter.
9. The method of claim 1 , wherein the at least one criteria comprises one or more of:
a rate of bad, bogus, or unregistered domain name DNS requests;
whether one or more portions of the first packet correlate with human language words;
one or more lengths of labels associated with the first packet;
a country code associated with the first packet;
a timing of updates received for the probabilistic data structure; or
syntactical characteristics of the first domain name.
10. A computing device comprising:
at least one processor; and
memory comprising instructions that, when executed by the at least one processor, cause the computing device to:
store a probabilistic data structure representing a subset of a plurality of domain names in a Domain Name System (DNS), wherein the probabilistic data structure representing the subset of the plurality of domain names in the DNS is selected from a plurality of probabilistic data structures representing a plurality of subsets of the plurality of domain names in the DNS based on false positive rates associated with the plurality of probabilistic data structures;
receive a plurality of packets;
determine, based on packet information, whether each respective packet of the plurality of packets comprises a domain name;
based on a determination that a first packet of the plurality of packets comprises a first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is registered in the DNS; and
based on a determination that the first domain name is not registered in the DNS:
determine, based on at least one criteria, a legitimacy of the first packet; and
based on the legitimacy, drop the first packet.
11. The computing device of claim 10 , wherein the memory further comprises instructions that cause the computing device to:
based on the determination that the first domain name is not registered in the DNS, transmit data regarding the first packet to a management server.
12. The computing device of claim 10 , wherein the memory further comprises instructions that cause the computing device to:
based on a determination that a second packet of the plurality of packets does not comprise a domain name, transmit the second packet towards its intended destination.
13. The computing device of claim 10 , wherein the memory further comprises instructions that cause the computing device to:
monitor network traffic for a response to a second packet;
based on the response to the second packet, insert a second domain name into the probabilistic data structure; and
transmit the second domain name to a management server.
14. The computing device of claim 10 , wherein the memory further comprises instructions that cause the computing device to:
determine a rate of received invalid DNS query requests associated with the first domain name;
determine whether the rate of received invalid DNS query requests satisfies a threshold; and
based on a determination that the rate of received invalid DNS query requests satisfies the threshold, determine the legitimacy of the first packet.
15. The computing device of claim 10 , wherein the memory further comprises instructions that cause the computing device to determine the legitimacy of the first packet by causing the computing device to:
determine whether a country code is associated with the first domain name;
determine whether the country code indicates a lag; and
based on a determination that the country code does not indicate the lag, determine the legitimacy of the first packet.
16. One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to:
store a probabilistic data structure representing a subset of a plurality of domain names in a Domain Name System (DNS), wherein the probabilistic data structure representing the subset of the plurality of domain names in the DNS is selected from a plurality of probabilistic data structures representing a plurality of subsets of the plurality of domain names in the DNS based on false positive rates associated with the plurality of probabilistic data structures;
receive a plurality of packets;
determine, based on packet information, whether each respective packet of the plurality of packets comprises a domain name;
based on a determination that a first packet of the plurality of packets comprises a first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is registered in the DNS; and
based on a determination that the first domain name is not registered in the DNS:
determine, based on at least one criteria, a legitimacy of the first packet; and
based on the legitimacy, drop the first packet.
17. The one or more non-transitory computer-readable media of claim 16 , further comprising instructions that cause the computing system to:
based on the determination that the first domain name is not registered in the DNS, transmit data regarding the first packet to a management server.
18. The one or more non-transitory computer-readable media of claim 16 , further comprising instructions that cause the computing system to:
based on a determination that a second packet of the plurality of packets does not comprise a domain name, transmit the second packet towards its intended destination.
19. The one or more non-transitory computer-readable media of claim 16 , further comprising instructions that cause the computing system to:
determine a rate of received invalid DNS query requests associated with the first domain name;
determine whether the rate of received invalid DNS query requests satisfies a threshold; and
based on a determination that the rate of received invalid DNS query requests satisfies the threshold, determine the legitimacy of the first packet.
20. The one or more non-transitory computer-readable media of claim 16 , further comprising instructions that cause the computing system to:
determine whether a country code is associated with the first domain name;
determine whether the country code indicates a lag; and
based on a determination that the country code does not indicate the lag, determine the legitimacy of the first packet.