System and apparatus for internet traffic inspection via localized dns caching

A system to support Internet traffic inspection, comprising:

• an inspection component configured to
• constantly monitor and intercept Internet traffic in form of one or more access requests from one or more users to access certain websites or resources hosted on a server on Internet;
• identify a pair of domain name and its corresponding IP address from each of the intercepted one or more access requests and save the pair to a Domain Name System (DNS) cache;
• look up a domain name of a newly intercepted access request from the DNS cache via an IP address of the newly intercepted access request if the newly intercepted access request contains only the IP address without the corresponding domain name of the website or resource;
• redirect the newly intercepted access request to a proxy server for further inspection if no domain name corresponding to the IP address of the newly intercepted access request is found in the DNS cache;
• said proxy server configured to
• determine whether the redirected access request is to access a malicious website or resource or not;
• handle the redirected access request accordingly based on whether the redirected access request is to access a malicious website or resource or not.