Domain name system (DNS) security
Novel tools and techniques are provided for implementing improvement to domain name system (“DNS”) security. In various embodiments, a computing system may receive a user datagram protocol (“UDP”)-based DNS request, and may send a UDP-based response message, which may include an empty payload portion and a header portion containing a truncate flag that is set, which indicates to resend the request as a transmission control protocol (“TCP”)-based DNS request. When the TCP-based DNS request is received within a first period, the computing system may send, to the source address, a TCP-based response message comprising an answer to a query (in the TCP-based DNS request) for a destination DNS record associated with a destination device. If no TCP-based DNS request is received from the source address within the first period, the computing system may block all UDP-based DNS requests from the source address for at least a second period.
1. A system, comprising:
a computing system of a domain name system (“DNS”), comprising:
at least one first processor; and
a first non-transitory computer readable medium communicatively coupled to the at least one first processor, the first non-transitory computer readable medium having stored thereon computer software comprising a first set of instructions that, when executed by the at least one first processor, causes the computing system to:
receive a first user datagram protocol (“UDP”)-based DNS request, the first UDP-based DNS request comprising a source address and a query for a destination DNS record associated with at least one of a destination device in a network, a destination entity associated with the destination device, or a destination domain associated with the destination device or the destination entity;
in response to receiving the first UDP-based DNS request, send a UDP-based response message to the source address, the UDP-based response message comprising an empty payload portion and a header portion containing truncate (“TC”) flag that is set;
when a first transmission control protocol (“TCP”)-based DNS request corresponding to the first UDP-based DNS request is not received from the source address within a first predetermined period, cause one or more second UDP-based DNS requests from the source address to be blocked, the one or more second UDP-based DNS requests comprising the first UDP-based DNS request;
when a first TCP-based DNS request corresponding to the first UDP-based DNS request is received from the source address within the first predetermined period, allow, within a second predetermined period after receiving the first TCP-based DNS request, at least the first UDP-based DNS request from the source address to be processed, by sending, to the source address, at least a TCP-based response message comprising an answer to the query for the destination DNS record:
receive, from the source address, one or more third UDP-based DNS requests, after the second predetermined period:
analyze, using a machine learning model, the one or more third UDP-based DNS requests, to determine whether or not to block the one or more third UDP-based DNS requests; and
perform one or more DNS tasks based on the analysis.
2. The system of claim 1 , wherein the computing system comprises at least one of a DNS resolver, a DNS recursive resolver (“recursor”), a DNS root nameserver, a top level domain (“TLD”) nameserver, an authoritative nameserver, a threat intelligence system, a threat mitigation system, a server, an artificial intelligence (“AI”) system, a machine learning (“ML”) system, a virtual machine (“VM”), or software running on the computing system.
3. The system of claim 1 , wherein the source address comprises at least one of a source port or a source IP address.
4. The system of claim 1 , wherein causing the one or more second UDP-based DNS requests from the source address to be blocked comprises at least one of:
updating one or more rules of at least one access control list (“ACL”) to deny access to the network to the source address;
dropping all DNS requests from the source address; or
filtering all DNS requests from the source address.
5. A method, comprising:
receiving, by a computing system of a domain name system (“DNS”), a first user datagram protocol (“UDP”)-based DNS request, the first UDP-based DNS request comprising a source address and a query for a destination DNS record associated with at least one of a destination device in a network, a destination entity associated with the destination device, or a destination domain associated with the destination device or the destination entity;
in response to receiving the first UDP-based DNS request, sending, by the computing system, a UDP-based response message to the source address, the UDP-based response message comprising an empty payload portion and a header portion containing a truncate (“TC”) flag that is set;
when a first transmission control protocol (“TCP”)-based DNS request corresponding to the first UDP-based DNS request is not received from the source address within a first predetermined period, causing, by the computing system, one or more second UDP-based DNS requests from the source address to be blocked, the one or more second UDP-based DNS requests comprising the first UDP-based DNS request;
when a first TCP-based DNS request corresponding to the first UDP-based DNS request is received from the source address within the first predetermined period, allowing, by the computing system and within a second predetermined period after receiving the first TCP-based DNS request, at least the first UDP-based DNS request from the source address to be processed, by sending, to the source address, at least a TCP-based response message comprising an answer to the query for the destination DNS record;
receiving, by the computing system and from the source address, one or more third UDP-based DNS requests, after the second predetermined period;
analyzing, by the computing system and using a machine learning model, the one or more third UDP-based DNS requests, to determine whether or not to block the one or more third UDP-based DNS requests; and
performing, by the computing system, one or more DNS tasks based on the analysis.
6. The method of claim 5 , wherein the computing system comprises at least one of a DNS resolver, a DNS recursive resolver (“recursor”), a DNS root nameserver, a top level domain (“TLD”) nameserver, an authoritative nameserver, a threat intelligence system, a threat mitigation system, a server, an artificial intelligence (“AI”) system, a machine learning (“ML”) system, a virtual machine (“VM”), or software running on the computing system.
7. The method of claim 5 , wherein causing the one or more second UDP-based DNS requests from the source address to be blocked comprises at least one of:
updating, by the computing system, one or more rules of at least one access control list (“ACL”) to deny access to the network to the source address;
dropping, by the computing system, all DNS requests from the source address; or
filtering, by the computing system, all DNS requests from the source address.
8. The method of claim 5 , wherein the source address comprises at least one of a source port or a source IP address.