Predictive DNS cache to improve security and performance
The present application discloses a method, system, and computer system for predicting responses to DNS queries. The method includes receiving a DNS query comprising a subdomain portion and a root domain portion from a client device, determining whether to obtain target address information corresponding to the DNS from a predictive cache, in response to determining to obtain the target address information from the predictive cache, obtaining the target address information from the predictive cache, and providing the target address information to the client device.
1. A system, comprising:
one or more processors configured to:
receive an indication to obtain target address information for a domain;
generate a predicted target address information for the domain query based at least in part on querying a machine learning model; and
provide the predicted target address information as the target address information for the domain; and
a memory coupled to the processor and configured to provide the processor with instructions;
wherein: the one or more processors are further configured to: in response to receiving a DNS query, determine whether to obtain target information corresponding to the domain from a predictive cache; and
the determining whether to obtain the target address information corresponding to the DNS query from the predictive cache comprises:
determining a query frequency for a domain associated with the DNS query is queried; and comparing the query frequency to a frequency threshold;
in response to determining the query frequency satisfies the frequency threshold, query a corresponding authoritative DNS server for the target address information;
in response to determining the query frequency does not satisfy the frequency threshold, determine to obtain the target address information from the predictive cache.
2. The system of claim 1 , wherein: the one or more processors are further configured to: in response to receiving a DNS query, querying a predictive cache to obtain the predicted target information for the domain associated with the DNS query; and in response to determining that the predictive cache does not currently store the target address information, use the machine learning model to determine the predicted target address information; and the predicted target address information is provided to a client device.
3. The system of claim 1 , wherein the machine learning model determines the predicted target address information without sending a received DNS query to an authoritative server corresponding to the domain associated with the DNS query.
4. The system of claim 1 , wherein the using the machine learning model to determine a predicted target address information comprises: obtaining top-level domain information pertaining to the domain associated with a DNS query; and generating address information for one or more sub-level domains pertaining to the domain associated with the DNS query, wherein: address information for one or more sub-level domains is estimated based at least in part on the machine learning model.
5. The system of claim 4 , wherein the top-level domain information is obtained based at least in part on querying a database that stores registered users or assignees of an Internet resource.
6. The system of claim 1 , wherein the one or more processors are further configured to: in response to receiving a DNS query, query a predictive cache to obtain the predicted target information for the domain associated with the DNS query; and in response to determining that the predictive cache does not currently store the target address information, block the DNS query.
7. The system of claim 6 , wherein: the DNS query is blocked based at least in part on a configuration set by an administrative user.
8. The system of claim 1 , wherein the predicted target address information is stored in a predictive cache, and the predictive cache stores a set of target addresses that are estimated based at least in part on corresponding top-level domain information.
9. The system of claim 8 , wherein records comprised in the predictive cache are generated using a machine learning process.
10. The system of claim 1 , wherein in the event that the target address information provided in response to a DNS query is obtained from a predictive cache, the DNS query is not communicated to an authoritative server corresponding to a domain associated with the DNS query.
11. The system of claim 1 , wherein: the one or more processors are further configured to: in response to receiving a DNS query, determine whether to obtain target information corresponding to the DNS query from a predictive cache; and determining whether to obtain target address information corresponding to the DNS query from the predictive cache comprises: determining whether the DNS query corresponds to suspicious traffic; and in response to determining that the DNS query corresponds to suspicious traffic, determining that the target address information is to be obtained from the predictive cache.
12. The system of claim 11 , wherein the determining whether the DNS query corresponds to suspicious traffic comprises providing the DNS query to a suspicious traffic detector.
13. The system of claim 11 , wherein the DNS query is determined to correspond to suspicious traffic based at least in part on whether a corresponding DNS is trusted or untrusted.
14. The system of claim 1 , wherein the predictive cache is comprised in a DNS resolver.
15. The system of claim 1 , wherein the predicted target address information is provided as the target address information for the domain in response to a DNS query.
16. A method, comprising:
receiving an indication to obtain target address information for a domain;
generating a predicted target address information for domain based at least in part on querying a machine learning model; and
providing the predicted target address information as the target address information for the domain;
in response to receiving a DNS query, determining whether to obtain target information corresponding to the domain from a predictive cache; and
the determining whether to obtain the target address information corresponding to the DNS query from the predictive cache comprises:
determining a query frequency for a domain associated with the DNS query is queried; and comparing the query frequency to a frequency threshold;
in response to determining the query frequency satisfies the frequency threshold, query a corresponding authoritative DNS server for the target address information;
in response to determining the query frequency does not satisfy the frequency threshold, determine to obtain the target address information from the predictive cache.
17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving an indication to obtain target address information for a domain;
generating a predicted target address information for domain based at least in part on querying a machine learning model; and
providing the predicted target address information as the target address information for the domain;
in response to receiving a DNS query, determining whether to obtain target information corresponding to the domain from a predictive cache; and
the determining whether to obtain the target address information corresponding to the DNS query from the predictive cache comprises:
determining a query frequency for a domain associated with the DNS query is queried; and comparing the query frequency to a frequency threshold;
in response to determining the query frequency satisfies the frequency threshold, query a corresponding authoritative DNS server for the target address information;
in response to determining the query frequency does not satisfy the frequency threshold, determine to obtain the target address information from the predictive cache.