Collecting passive DNS traffic to generate a virtual authoritative DNS server
The present application describes a system and method for passively collecting DNS traffic data as that data is passed between a recursive DNS resolver and an authoritative DNS server. The information contained in the collected DNS traffic data is used to generate a virtual authoritative DNS server, or a zone associated with the authoritative DNS server, when it is determined that the authoritative DNS server has been compromised.
1. A method, comprising:
capturing domain name system (DNS) data;
receiving a trigger notification, the trigger notification indicating a zone associated with an authoritative DNS server is compromised;
causing a recursive DNS resolver to retrieve last known valid information associated with the zone from an observer system, the last known valid information being captured from the DNS data;
generating a virtual zone using the last known valid information; and
causing the recursive DNS resolver to host the virtual zone.
2. The method of claim 1 , wherein the authoritative DNS server is associated with a first entity and the recursive DNS resolver is associated with a second entity.
3. The method of claim 1 , wherein the domain name system data is passively captured by the observer system.
4. The method of claim 1 , further comprising deconstructing the virtual zone when the trigger notification is resolved.
5. The method of claim 1 , wherein cached information is an internet protocol (IP) address associated with the authoritative DNS server.
6. The method of claim 1 , further comprising causing the virtual zone to provide a last known valid internet protocol (IP) address associated with the authoritative DNS server.
7. The method of claim 1 , further comprising causing the virtual zone to provide public key data information to a requesting device.
8. The method of claim 1 , further comprising enabling the recursive DNS resolver to provide private key data information to a requesting device.