Introduction:
I'm currently developing a piece of software that requires the ability to dynamically filter DNS requests (and possibly filtering other network traffic based on the IP addresses associated with those domains in the future).
A big part of the reason for doing this is because we ideally would want a whitelist only approach but due to the nature of the business we have to visit sites outside this list on a regular basis. If it's too easy to just add sites to the whitelist it removes many of the benefits of such an approach.
Specifically I'm looking at filtering DNS queries based on some statistical properties including page content and history of network traffic to the associated IPs. I currently have a python based program that's computing the probabilities that a site falls into certain categories (eg malware site, XYZ site etc). This analyzes some keywords in the page and also is taking into account recent traffic history. This means that the filtering rules can change from minute to minute. I know there's a bunch of different solutions out there that will work well with fixed lists and static rules, but I'm looking to generate the blacklists dynamically based on traffic that's going across the network from different users.
Question:
Are there existing solutions that can blacklist and whitelist based on a dynamic set of rules that are generated from another process?
If there's no software with an easy to use API then what proxy software would be the easiest for me to either:
- write a plugin for? or
- modify the source directly?
An open source license would be a massive win here (because I plan to open source much of this code if the licenses allow it).
But other suggestions are also appreciated.
