US 11,902,250 B2
Methods and systems for prevention of attacks associated with the domain name system
Sean Moore, Hollis, NH (US); Jonathan R. Rogers, Hampton Falls, NH (US); and Steven Rogers, Leesburg, VA (US)
Assigned to Centripetal Networks, LLC, Portsmouth, NH (US)
Filed by Centripetal Networks, LLC, Portsmouth, NH (US)
Filed on Apr. 1, 2021, as Appl. No. 17/220,407.
Application 17/220,407 is a continuation of application No. 16/692,365, filed on Nov. 22, 2019, granted, now 11,012,414, issued on May 18, 2021.
Application 16/692,365 is a continuation in part of application No. 16/399,700, filed on Apr. 30, 2019, granted, now 10,951,585.
Prior Publication US 2021/0250332 A1, Aug. 12, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 61/4511 (2022.01)
CPC H04L 63/0245 (2013.01) [H04L 61/4511 (2022.05); H04L 63/1458 (2013.01); H04L 63/20 (2013.01); H04L 2463/142 (2013.01)] 23 Claims
OG exemplary drawing
 
1. A method comprising:
storing, by a gatekeeper device that controls query access to a Domain Name System (DNS), a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprise a subset of domain names resolvable by the DNS, wherein the plurality of domain names were received from a plurality of different domain name servers, and wherein at least two of the plurality of different domain name servers are managed by different organizations;
receiving, by the gatekeeper device, one or more packets comprising a DNS query;
determining, based on packet information, whether the one or more packets comprise a first domain name;
based on determining that the one or more packets comprise the first domain name, testing, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure; and
based on a determination that the first domain name is not represented in the probabilistic data structure:
determining, based on at least one criteria, a legitimacy of a first DNS request contained in the one or more packets; and
based on the legitimacy, dropping the one or more packets.