Methods and systems for prevention of attacks associated with the domain name system

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause a gatekeeper device that controls query access to a Domain Name System (DNS) to:

• store a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprise a subset of domain names resolvable by the DNS, wherein the plurality of domain names were received from a plurality of different domain name servers, and wherein at least two of the plurality of different domain name servers are managed by different organizations;
• receive one or more packets comprising a DNS query;
• determine, based on packet information, whether the one or more packets comprise a first domain name;
• based on determining that the one or more packets comprise the first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure;
• and
• based on a determination that the first domain name is not represented in the probabilistic data structure:
• determine, based on at least one criteria, a legitimacy of a first DNS request contained in the one or more packets;
• and
• based on the legitimacy, drop the one or more packets.

An apparatus that controls query access to a Domain Name System (DNS) comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• store a probabilistic data structure representing a plurality of domain names, wherein the plurality of domain names comprise a subset of domain names resolvable by the DNS, wherein the plurality of domain names were received from a plurality of different domain name servers, and wherein at least two of the plurality of different domain name servers are managed by different organizations;
• receive one or more packets comprising a DNS query;
• determine, based on packet information, whether the one or more packets comprise a first domain name;
• based on determining that the one or more packets comprise the first domain name, test, without querying the DNS, the probabilistic data structure to determine if the first domain name is represented in the probabilistic data structure;
• and
• based on a determination that the first domain name is represented in the probabilistic data structure:
• determine, based on at least one criteria, a legitimacy of a first DNS request contained in the one or more packets;
• and
• based on the legitimacy, drop the one or more packets.