5

Introduction:

I'm currently developing a piece of software that requires the ability to dynamically filter DNS requests (and possibly filtering other network traffic based on the IP addresses associated with those domains in the future).

A big part of the reason for doing this is because we ideally would want a whitelist only approach but due to the nature of the business we have to visit sites outside this list on a regular basis. If it's too easy to just add sites to the whitelist it removes many of the benefits of such an approach.

Specifically I'm looking at filtering DNS queries based on some statistical properties including page content and history of network traffic to the associated IPs. I currently have a python based program that's computing the probabilities that a site falls into certain categories (eg malware site, XYZ site etc). This analyzes some keywords in the page and also is taking into account recent traffic history. This means that the filtering rules can change from minute to minute. I know there's a bunch of different solutions out there that will work well with fixed lists and static rules, but I'm looking to generate the blacklists dynamically based on traffic that's going across the network from different users.

Question:

Are there existing solutions that can blacklist and whitelist based on a dynamic set of rules that are generated from another process?

If there's no software with an easy to use API then what proxy software would be the easiest for me to either:

  • write a plugin for? or
  • modify the source directly?

An open source license would be a massive win here (because I plan to open source much of this code if the licenses allow it).
But other suggestions are also appreciated.

0

WinGate has a DNS server built in, and also an extension SDK allowing you to write filters that can analyze web and other traffic (as well as extend WinGate in many other areas).

The SDK is documented here

The built-in event/policy system allows you to make custom DNS responses (currently only A records), based on data from: internal (globals, counters etc), the request, or external (file or DB) sources.

DNS traffic is not license-limited, so if you're just analyzing DNS, you wouldn't even need to purchase a license, however we offer a free 3 concurrent user license (soon to be extended to 10 users). We also offer free support, and would be willing to extend our SDK / APIs for DNS filtering specifically.

Disclaimer: I work for Qbik who are the authors of WinGate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.