Methods and systems for prevention of attacks associated with the domain name system
The attack vectors for some denial-of-service cyber attacks on the Internet's Domain Name System (DNS) are bad, bogus, or unregistered domain name DNS requests to resolve domain names that are not registered in the DNS. Some other cyber attacks steal sensitive data by encoding the data in bogus domain names, or domain names otherwise not registered in the DNS, that are transferred across networks in bogus DNS requests. A DNS gatekeeper may filter in-transit packets containing DNS requests and may efficiently determine if a request's domain name is registered in the DNS. When the domain name is not registered in the DNS, the DNS gatekeeper may take one of a plurality of protective actions. The DNS gatekeeper drops requests determined not to be legitimate, which may prevent an attack.
1 . A method comprising:
storing, by a gatekeeper device that controls query access to a Domain Name System (DNS), a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprises a subset of domain names resolvable by the DNS, wherein at least two of the plurality of domain names originated from different domain name servers, of a plurality of domain name servers, managed by different organizations;
receiving, by the gatekeeper device, one or more packets comprising a DNS query;
determining, based on packet information, whether the one or more packets comprise a first domain name;
based on determining that the one or more packets comprise the first domain name, testing, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure; and
based on a determination that the first domain name is not represented in the probabilistic data structure:
determining whether at least a portion of the first domain name is being used to exfiltrate data based on detecting at least a portion of the data in the first domain name;
based on a determination that the at least the portion of the first domain name is being used to exfiltrate the data, dropping the one or more packets; and
transmitting a DNS response to a sender of the one or more packets.
2 . The method of claim 1 , wherein the DNS response comprises an NXDOMAIN response code.
3 . The method of claim 1 , wherein the determining that the at least the portion of the first domain name is being used to exfiltrate the data is further based on one or more of:
a frequency of DNS queries received from the sender,
one or more lengths of labels associated with the one or more packets, or
syntactical characteristics of the first domain name.
4 . The method of claim 1 , wherein the determining that the at least the portion of the first domain name is being used to exfiltrate the data is further based on a determination that a destination of the one or more packets does not send a DNS response to the DNS query.
5 . The method of claim 1 , further comprising:
receiving, by the gatekeeper device and from a second sender, one or more second packets comprising a second DNS query;
testing, without querying the DNS, the probabilistic data structure to determine if a second domain name indicated by the one or more second packets is represented in the probabilistic data structure; and
based on a determination that a second domain name indicated by the one or more second packets is not represented in the probabilistic data structure and a determination, based on a frequency of packets received from the second sender, that the one or more second packets are associated with a denial of service attack:
dropping the one or more second packets.
6 . The method of claim 1 , further comprising:
based on the determination that the first domain name is not represented in the probabilistic data structure, transmitting data regarding the one or more packets to a management server.
7 . The method of claim 1 , further comprising:
based on a determination that one or more second packets do not comprise a domain name, transmitting, without testing the probabilistic data structure, the one or more second packets toward their intended destination.
8 . The method of claim 1 , further comprising:
based on a determination that one or more second packets comprise a second domain name, testing, without querying the DNS, the probabilistic data structure to determine if the second domain name is represented in the probabilistic data structure; and
based on a determination that the second domain name is represented in the probabilistic data structure, transmitting the one or more second packets toward their intended destination.
9 . The method of claim 1 , further comprising:
testing, without querying the DNS, the probabilistic data structure to determine if a second domain name of one or more second packets is represented in the probabilistic data structure;
based on a determination that the second domain name is not represented in the probabilistic data structure, determining whether a second DNS request contained in the one or more second packets is legitimate; and
based on a determination that the second DNS request contained in the one or more second packets is legitimate, transmitting the one or more second packets towards their intended destination.
10 . The method of claim 1 , wherein the probabilistic data structure is one of:
a Bloom filter; or
a Cuckoo filter.
11 . A gatekeeper device that controls query access to a Domain Name System (DNS), the gatekeeper device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the gatekeeper device to:
store a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprises a subset of domain names resolvable by the DNS, wherein at least two of the plurality of domain names originated from different domain name servers, of a plurality of domain name servers, managed by different organizations;
receive one or more packets comprising a DNS query;
determine, based on packet information, whether the one or more packets comprise a first domain name;
based on determining that the one or more packets comprise the first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure; and
based on a determination that the first domain name is not represented in the probabilistic data structure:
determine whether at least a portion of the first domain name is being used to exfiltrate data based on detecting at least a portion of the data in the first domain name;
based on a determination that the at least the portion of the first domain name is being used to exfiltrate the data, drop the one or more packets; and
transmit a DNS response to a sender of the one or more packets.
12 . The gatekeeper device of claim 11 , wherein the DNS response comprises an NXDOMAIN response code.
13 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to determine that the at least the portion of the first domain name is being used to exfiltrate the data further based on one or more of:
a frequency of DNS queries received from the sender,
one or more lengths of labels associated with the one or more packets, or
syntactical characteristics of the first domain name.
14 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to determine that the at least the portion of the first domain name is being used to exfiltrate the data further based on a determination that a destination of the one or more packets does not send a DNS response to the DNS query.
15 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to:
receive, from a second sender, one or more second packets comprising a second DNS query;
test, without querying the DNS, the probabilistic data structure to determine if a second domain name indicated by the one or more second packets is represented in the probabilistic data structure; and
based on a determination that a second domain name indicated by the one or more second packets is not represented in the probabilistic data structure and a determination, based on a frequency of packets received from the second sender, that the one or more second packets are associated with a denial of service attack:
drop the one or more second packets.
16 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to:
based on the determination that the first domain name is not represented in the probabilistic data structure, transmit data regarding the one or more packets to a management server.
17 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to:
based on a determination that one or more second packets do not comprise a domain name, transmit, without testing the probabilistic data structure, the one or more second packets toward their intended destination.
18 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to:
based on a determination that one or more second packets comprise a second domain name, test, without querying the DNS, the probabilistic data structure to determine if the second domain name is represented in the probabilistic data structure; and
based on a determination that the second domain name is represented in the probabilistic data structure, transmit the one or more second packets toward their intended destination.
19 . The gatekeeper device of claim 11 , wherein the instructions, when executed by the one or more processors, cause the gatekeeper device to:
test, without querying the DNS, the probabilistic data structure to determine if a second domain name of one or more second packets is represented in the probabilistic data structure;
based on a determination that the second domain name is not represented in the probabilistic data structure, determine whether a second DNS request contained in the one or more second packets is legitimate; and
based on a determination that the second DNS request contained in the one or more second packets is legitimate, transmit the one or more second packets towards their intended destination.
20 . The gatekeeper device of claim 11 , wherein the probabilistic data structure is one of:
a Bloom filter; or
a Cuckoo filter.
21 . One or more non-transitory computer-readable media storing instructions that, when executed by a gatekeeper device that controls query access to a Domain Name System (DNS), cause the gatekeeper device to:
store a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprises a subset of domain names resolvable by the DNS, wherein at least two of the plurality of domain names originated from different domain name servers, of a plurality of domain name servers, managed by different organizations;
receive one or more packets comprising a DNS query;
determine, based on packet information, whether the one or more packets comprise a first domain name;
based on determining that the one or more packets comprise the first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure; and
based on a determination that the first domain name is not represented in the probabilistic data structure:
determine whether at least a portion of the first domain name is being used to exfiltrate data based on detecting at least a portion of the data in the first domain name;
based on a determination that the at least the portion of the first domain name is being used to exfiltrate the data, drop the one or more packets; and
transmit a DNS response to a sender of the one or more packets.
22 . The one or more non-transitory computer-readable media of claim 21 , wherein the DNS response comprises an NXDOMAIN response code.
23 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to determine that the at least the portion of the first domain name is being used to exfiltrate the data further based on one or more of:
a frequency of DNS queries received from the sender,
one or more lengths of labels associated with the one or more packets, or
syntactical characteristics of the first domain name.
24 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to determine that the at least the portion of the first domain name is being used to exfiltrate the data further based on a determination that a destination of the one or more packets does not send a DNS response to the DNS query.
25 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to:
receive, from a second sender, one or more second packets comprising a second DNS query;
test, without querying the DNS, the probabilistic data structure to determine if a second domain name indicated by the one or more second packets is represented in the probabilistic data structure; and
based on a determination that a second domain name indicated by the one or more second packets is not represented in the probabilistic data structure and a determination, based on a frequency of packets received from the second sender, that the one or more second packets are associated with a denial of service attack:
drop the one or more second packets.
26 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to:
based on the determination that the first domain name is not represented in the probabilistic data structure, transmit data regarding the one or more packets to a management server.
27 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to:
based on a determination that one or more second packets do not comprise a domain name, transmit, without testing the probabilistic data structure, the one or more second packets toward their intended destination.
28 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to:
based on a determination that one or more second packets comprise a second domain name, test, without querying the DNS, the probabilistic data structure to determine if the second domain name is represented in the probabilistic data structure; and
based on a determination that the second domain name is represented in the probabilistic data structure, transmit the one or more second packets toward their intended destination.
29 . The one or more non-transitory computer-readable media of claim 21 , wherein the instructions, when executed, cause the gatekeeper device to:
test, without querying the DNS, the probabilistic data structure to determine if a second domain name of one or more second packets is represented in the probabilistic data structure;
based on a determination that the second domain name is not represented in the probabilistic data structure, determine whether a second DNS request contained in the one or more second packets is legitimate; and
based on a determination that the second DNS request contained in the one or more second packets is legitimate, transmit the one or more second packets towards their intended destination.
30 . The one or more non-transitory computer-readable media of claim 21 , wherein the probabilistic data structure is one of:
a Bloom filter; or
a Cuckoo filter.