[Android Software/Hacking General [Developers Only]] MrT69:
keweonDNS – info, facts and why is keweon more than ad blocker and browser privacy

First, I would like to thank everyone who has used and thus supported keweonDNS, because without you this would not have been possible. The XDA Developers Forum and the Android-Hilfe Forum many thanks, as sometimes things aren't easy with me.

Everything I've developed over the last few years has to do with DNS, and this provides a little insight into what you can accomplish with DNS. Clearly, it functions, it performs – but maybe some of you have a piece of advice on what I can do differently or perhaps even better, after all, I'm up for everything.

With that said, here's the answer to what is keweon. In a nutshell – THIS is keweon:

At this stage, I will not be able to outline all the details here in the forum. On the one hand it becomes too much and on the other hand “the giants” – you have cribbed enough from me so far – also read here. By now, the planned public documentation exceeds 100 pages, and I intend to accommodate and cover everything. So, before I post everything on the website, I'll first share it here on the forum with a limited group of contributors, as I'm interested in questions, feedback, and perhaps one or two remarks.

Why bio-neural network?

The most well-known neural network is the brain, whether in humans, animals, or plants, where information is perceived, classified, prioritized, and processed. As far as humans are concerned, the information is transmitted via sensors. In IT, this is called an “agent”, an unfortunate choice of words, in my opinion.

Sensors refer to basically anything that receives and transmits data. Nose, tongue, and eye are for instance sensors that transmit information to the brain and when processed in the brain, the neural network, triggers an action. Example: Fire (vision – sensor eye) + Smoke (smell – sensor nose) = Action (decision triggered by the neural network) is escape.

The goal of an AI is to artificially reproduce this “biological” behavior or sequence. The same applies in IT as in biology, a neural network must always be part of an AI. For me, there is no superior way than to apply this kind of approach to DNS.

How does keweon act as an “artificial neural network”?

What you see here is the so-called “frontend”. The one you know as the keweonDNS server:

Spoiler content hidden.

There is nothing special here yet, nor does it have anything to do with “AI” or “ANN”. We will go into this in more detail shortly.

Let's talk about the “bio” factor. — To ensure that the keweon AI only does what it is designed to do, it was essential to set up not just one, but several control instances. Policing of the AI rests not only with the AI itself, but also with the user and with me. That is why I have used the term “Shared Manage & Controlling” to describe this process.

Internal control mechanisms within the AI guarantee that the system regulates, manages, and even polices itself. As an example, if the AI is manipulated by an external attack, a variety of defensive countermeasures are triggered, up to the most severe case, shutting down the infrastructure entirely. At this point, the DNS would remain operational, but at a slower pace and only with the default responses of the global root DNS servers.

By leveraging keweonDNS servers, each user, and their device, whether it's a cell phone, PC, or IoT device, automatically becomes part of the artificial neural network. To top it off – none of the user data is required to be collected for this, or even necessary at all. Through the query arises the control, and through the control arises the answer. In this way, sensory control and sensory data transmission occur simultaneously with the DNS query. Based on the term “crowdsourcing”, I have called this process “crowd request sourcing”.

User data collection at keweon?

At this point, I will only briefly outline the matter of data collection and processing, since that would completely go beyond the scope here.

No information is collected from users, devices, or other sensitive data within the scope of the GDPR; rather, the information processed relates solely to the DNS request. In other words, the address, FQDN, host or alias of the DNS request, namely only data that a DNS server possesses inherently, is used for this purpose. It doesn't matter who or what requested the address, only how often an address is queried becomes an additional assessment criterion for the AI. In part, this looks like this:

Spoiler content hidden.

As a result, you can spot things, as seen here on the Apple iPhone, wherein strange DoH resolvers are doing DNS resolution in a hidden way. Apple's commitment to data security and privacy already belongs to the past. Especially, with the implementation of the advertising framework in the iOS operating system, the company is sawing at the branch it is sitting on, in my personal view.

At no time will keweonDNS collect or parse user data. The mistakes made by Jan Koum have taught me a lot. That's why I designed the entire development to make it technically impossible to ever do that. Data is processed only from the “root DNS server” to protect the user's privacy. In this way, “hidden (user) data collection” is prevented and ruled out, even if investors enter the project.

The fact that this is impossible turned out to be something I did not expect, indeed a knockout criterion for investors. Still, my point of view in this regard should be well known. Further details on data protection can be expected on the website in the section “AI & Data Protection”.

How does DNS work at keweon?

It functions not unlike any other DNS server.

Query from your device to DNS: What is the IP address of www.example.com?

DNS looks in the cache. If the response resides there, your device will get the IP address.

If the address is not in the cache, the subsequent (virtual) response occurs:

Wait, I don't know the address, but I do know a DNS server that might be aware of the answer.

Passing the query to the next DNS server (henceforth, it is no longer the IP address of the user who asks the query, instead it's the DNS server).

Passing the query to the root DNS server, which looks up the response. If the root DNS server does not know the response, it returns an NXDomain response, which means “Not existing domain“, or the matching IP address is returned.

The response passes through one or more validations and is then returned to your device as a response via the DNS resolvers.

DNS Mission accomplished.

The so-called “Visible Layer“, which are the DNS servers that you use, respond as DNS, are DNS and do DNS. All they provide is DNS over port 53 – and nothing else. No proxy, no other technology. 100% DNS. Well, companies that offer solutions for DNS-layer security – please keep reading, you may learn something. (#CISCO, #Cloudflare, #Microsoft, #Google, #Apple)

The AI, the so-called “AI Hidden Layer”, is the exciting part. In this context, the term “hidden layer” is used when referring to an AI because the AI itself is never directly addressed and is invisible to the user.

The “AI Hidden Layer” is a self-contained layer, or rather should be, to prevent manipulation or attacks. By far the best example of how an AI should not be built is Microsoft's “Bing AI”. It is reported that the staff there is already busy working on the implementation of AI-provided advertisements and sponsored responses. Effectively, this soon means that whoever pays more has the privilege to manipulate on a larger scale. Like Apple, this clearly shows that mistakes (from the past) are obviously ignored instead of drawing lessons therefrom.

AI and ANN – an architectural overview

The DNS server, the “hidden layer” that enables the entire technology, is shown in the figure:

Spoiler content hidden.

I tried to keep it simple, and I hope it turned out well. If you have any questions – please let me know.

Hidden Layer – how does keweon act as an “artificial bio-neural network”?

We take the address “www.i-net.nx” as an example and assume that this is requested for the first time. The address in question is a “good address” invoking a “bad address” in the background – i.e., “bad.i‑net.nx” via a JavaScript, and so remains invisible to the user. Even though the TLD “.nx” does not exist obviously, we assume that it does.

The query originates from a cell phone and is transmitted to the keweonDNS servers.

Assume that here a fictitious counter starts with 0ms (0 milliseconds).

The DNS server doesn't know the address and passes on this request.

So far, ordinary DNS – now we let the magic begin!

Prior to forwarding, two databases are queried to see if this address is known in the “Allow or Deny” database. Of course not, we assumed a totally unknown and completely unfamiliar address.

The query i-net.nx is now forwarded by the ANN (Artificial Neural Network) to the root DNS servers, which in turn query the global root DNS servers. Within the ANN, this address is “copied” and passes through some checks in parallel, regardless of what is returned as a response.

The query is passed to the keweon root servers, which in turn passes it to the AI and analyzes it via the Pre.Ident process, which works with data such as “Newly Registered Domains”.

Note: “DNS firewalls”, for example, have a feature that blocks all newly registered DNS domains. Basically, pointless, and wrongly implemented – yet companies spend a lot of money on this feature and fill meaningless colorful dashboards with it. All that matters though is that they are colorful and have KPIs – no one questions whether this makes sense.

The security benefit on a scale of 1 to 10 is -10, since this represents a security risk on one side and pretends a “misleading security” on the other side. “Newly Registered Domains” are verified at keweonDNS via the Pre.Ident process and are not blocked across the board.

Spoiler content hidden.

The Pre.Ident process performs the initial analysis of the query and is responsible for detecting threats that are emerging or may arise. As mentioned at the beginning, this can also be done with probability theory, for example, but this has proven to be too inefficient and too slow. The current predictions for “bad domains” extend up to 96 hours (4 days) into the future. This is calculated using the HFRA algorithm (High Frequency Research Algorithm), among others.

All AI processes and algorithms, such as Pre.Ident and the HFRA, are completely independent of each other, but support each other or collude.

The idea for the HFRA algorithm initially originated from a good friend, who sadly passed away from a brain tumor in 2017. Harlim was the lead developer for high frequency trading at a large German bank, and he contributed a lot despite his illness. High frequency trading ends with buy or don't buy, or to stay with DNS, block or don't block.

After the Pre.Ident process, the domain is decomposed into FQDN, IP, and Alias and inspected i.e., using the certificate instance. The big secret with the certificates is hence, on the one hand, to assign a positive certificate to all blocked addresses and, on the other hand, to be able to check and classify the DNS data on the fly. This procedure eliminates the need to resort to further DNS data and ensures the (self-)control of the AI.

Meanwhile, the ANN has (pre)analyzed the address and the PAA (Perimeter Analytics Algorithm) checks whether the server contains, i.e., malware or ransomware or whether this server shows other critical or endangering indications.

Whether and how a server, address, or IP is “malicious” is weighed by the various logics. The current criteria catalog includes a total of 1394 so-called matching points, how an address is to be evaluated if it is known, and up to 83 matching points for unknown addresses (floating run), whereby various factors also play a role.

Using fuzzy logic within the AI and with the help of the ANN, not only is it decided whether an address is “good” or “bad”, but also the result “I'm not quite sure” can be generated. This in turn causes a weighting and the ANN decides here “Allow or Deny” – based on further algorithms.

This decision that it is probably a good address is passed to a “returning logic“, evaluated as good, and thus the original IP address is returned to the user. It looks roughly as follows (in excerpts):

Spoiler content hidden.

Let's stop the fictitious counter here (which we started at the beginning) and now, about 20ms (milliseconds) later, the user gets the response.

The returning cycle decides here when and if this address must be examined again, in which level of detail and possibly via a second, third etc. analysis of the address in the background. Different criteria are used depending on the weighting. Some addresses are checked every hour, others every week.

The web page is loaded and, as noted, it contains a JavaScript with the bad address. Since this address has at no time been requested, it is blocked from point 5, at the latest from point 6. The user gets this address returned, but with an IP address that states this address was successfully resolved and passes a virtual “OK” to the browser or JavaScript to make it believe that the address was properly resolved and does not need to be requested again.

If the address has now been resolved, the AI's work continues anyway. The address is reviewed again for a more detailed assessment of the threat posed by the address, as well as its rating. For this purpose, the address gets analyzed in detail in the background using the crowd request sourcing method and the HFRA algorithm. This time the entire program, because now it compares, for example, where the server is located, what the IP address does, what the server does, along with other options, and the results are again compared with other and similar addresses.

For one or two addresses this still sounds logical, but if we now take 20 or 30 addresses, it becomes more complex. The database currently consists of about 960 million addresses.

Summary

This is just a small part of what keweon is all about. Obviously, there is much more, but for now I'm curious to see who copies all this and uses it for their marketing. Admittedly, who knows me a little, understands that this is far from being everything.

The thing I'd like to know from you now:

What do you think about it? How do you rate it? What information do you miss here?

Comments, hints, tips, and questions are welcome and appreciated.