DNS resolver prioritization

Patent metadata

Field	Value
Publication number	US-9979588-B1
Application number	US-201514623408-A
Country	US
Kind code	B1
Filing date	Feb 16, 2015
Priority date	Feb 16, 2015
Publication date	May 22, 2018
Grant date	May 22, 2018

Abstract

A technology is described for prioritizing DNS name resolutions requests received from DNS resolvers. An example method may include receiving a DNS name resolution request addressed to a DNS name server from a DNS resolver. The DNS resolver associated with the DNS name resolution request may be identified as a known DNS resolver or an unknown DNS resolver, where a known DNS resolver may have DNS resolver characteristics that correspond to a valid DNS resolver. The DNS name resolution request may be prioritized according to the identity of the DNS resolver as a known DNS resolver or an unknown DNS resolver. The DNS name resolution request may then be provided to the DNS name server according to the priority assigned to the DNS name resolution request.

First claim

What is claimed is:

1. A non-transitory machine readable storage medium having instructions embodied thereon, the instructions when executed by a processor:
obtain historical data for DNS (Domain Name System) name resolution requests associated with an IP (Internet Protocol) address for a DNS resolver that queries a DNS name server for DNS name resolutions;
analyze the historical data associated with the DNS resolver for DNS resolver characteristics that are associated with valid DNS resolvers, wherein the DNS resolver characteristics include:
an IP address that is static from several days to several months, queries for DNS name resolutions for which the DNS name server is an authoritative DNS name server, queries for DNS name resolutions of valid domain names, and queries for DNS name resolutions for multiple domain names;
identify the DNS resolver as a known DNS resolver having at least a DNS resolver characteristic that a substantial number of the resolution requests received from the DNS resolver are requests for a resolution of a valid domain name;
assign a higher priority to DNS name resolution requests received from the known DNS resolver as compared to a priority assigned to DNS name resolution requests associated with unknown DNS resolvers; and
provide the DNS name resolution requests to the DNS name server according to a priority for the DNS name resolution requests.

2. A non-transitory machine readable storage medium as in claim 1 , wherein the instructions that when executed by the processor prioritize the DNS name resolution requests according to whether a DNS resolver is identified as a known DNS resolver or an unknown DNS resolver use a Bloom filter that indicates whether the DNS resolver is included in a set of known DNS resolvers.

3. A non-transitory machine readable storage medium as in claim 1 , wherein instructions when executed by the processor further drop DNS name resolution requests as a result of a capacity of a computing environment to accept DNS name resolution requests being full and as a result of a priority for the DNS name resolution requests being lower as compared to a priority assigned to DNS name resolution requests associated with known DNS resolvers.

4. A computer implemented method, comprising: under control of one or more computer systems configured with executable instructions,
analyzing historical data for resolution requests associated with a DNS (Domain Name System) resolver for DNS resolver characteristics that are associated with valid DNS resolvers;
identifying the DNS resolver as a known DNS resolver based in part on a DNS resolver characteristic that a substantial number of the resolution requests received from the DNS resolver are requests for a resolution of a valid domain name;
receiving a DNS name resolution request via a computer network, the DNS name resolution request being sent by the DNS resolver and being addressed to a DNS name server;
assigning a higher priority to the DNS name resolution request received from the known DNS resolver, wherein requests from the known DNS resolver receive the higher priority as compared to a priority assigned to requests from unknown DNS resolvers; and
providing the DNS name resolution request to the DNS name server via the computer network according to the higher priority assigned to the DNS name resolution request.

5. A method as in claim 4 , wherein identifying the DNS resolver as a known DNS resolver further comprises:
determining whether the DNS resolver is included in a set of known DNS resolvers wherein at least one of: a Bloom filter, a trie data structure, a bitmap data structure, a B-tree or a hash table are used to store the set of known DNS resolvers.

6. A method as in claim 5 , further comprising:
periodically analyzing the historical data associated with DNS name resolution requests made by DNS resolvers to determine which of the DNS resolvers to include in the set of known DNS resolvers; and
updating the set of known DNS resolvers as a result of the analyzing.

7. A method as in claim 4 , wherein assigning the priority to the DNS name resolution request further comprises:
assigning a priority to a DNS name resolution request from a public DNS resolver that is lower than a priority assigned to the known DNS resolver, wherein public DNS resolvers are DNS resolvers providing domain name resolutions for destination hosts accessible via the Internet to any client device connected to the Internet; and
assigning a priority to a DNS name resolution request from an unknown DNS resolver that is lower than a priority assigned to the public DNS resolver.

8. A method as in claim 4 , further comprising dropping the DNS name resolution request having a priority lower than a priority assigned to a known DNS resolver as a result of a capacity for a computing environment being fully utilized.

9. A method as in claim 4 , further comprising obtaining the historical data associated with network addresses for DNS resolvers that query a DNS name server for domain name resolutions; and
classifying network addresses as known DNS resolvers using the historical data, wherein the historical data is obtained from at least one of: DNS server logs, network attack mitigation device logs, or a record of DNS resolvers having static network addresses.

10. A method as in claim 4 , further comprising identifying the DNS resolver as a known DNS resolver where the DNS resolver has a network address that is unchanged over a period of time.

11. A method as in claim 4 , further comprising identifying the DNS resolver as a known DNS resolver where the DNS resolver has a network address that is static and where a TTL (Time-To-Live)value for the network address falls within an expected TTL range for the network address.

12. A method as in claim 4 , further comprising identifying the DNS resolver as a known DNS resolver if the DNS resolver queries the DNS name server for a resolution of a domain name for which the DNS name server is an authoritative DNS name server.

13. A method as in claim 4 , further comprising identifying the DNS resolver as a known DNS resolver as part of a determination that the DNS resolver is an ISP (Internet Service Provider) DNS resolver.

14. A method as in claim 4 , further comprising identifying the DNS resolver as a known DNS resolver where the DNS resolver does not query the DNS name server for a DNS record prior to an expiration of a TTL for the DNS record.

15. A method as in claim 9 , wherein classifying network addresses as known DNS resolvers further comprises:
assigning a score to a network address for a DNS resolver according to characteristics of the DNS resolver that correspond to a valid DNS resolver; and
including the network address in a set of known DNS resolvers as a result of the score meeting a threshold value.

16. A system comprising:
a processor; and
a memory device including instructions that, when executed by the processor, cause the system to:
obtain historical data for resolution requests associated with a network address for a DNS (Domain Name System) resolver that makes DNS name resolution requests to a DNS name server;
analyze the historical data associated with the DNS resolver for DNS resolver characteristics that are associated with valid DNS resolvers;
classify the DNS resolver as a known DNS resolver based in part on a DNS resolver characteristic that a substantial number of the resolution requests associated with the network address for the DNS resolver were for a resolution of a valid domain name; and
add the network address to a Bloom filter used to dete

Assignees

• Amazon Tech Inc

Inventors

• Benson Bryan Mark
• Lu David Dongyi
• Diggins Michael F
• Wang Xingbo
• Maccarthaigh Colm

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L61/106

  across networks, e.g. mapping telephone numbers to data network addresses · CPC title

• H04L29/12066 Primary

  Electricity · mapped topic

• H04L61/6068

  Electricity · mapped topic

• H04L61/1511

  Electricity · mapped topic