Back to results
US 10,257,221 B2Granted
Selective sinkholing of malware domains by a security device via DNS poisoning
AssigneePalo Alto Networks, Inc.
InventorsHuagang Xie, Taylor Ettema
Life of this patent
Estimating the term…
Abstract
Techniques for selective sinkholing of malware domains by a security device via DNS poisoning are provided. In some embodiments, selective sinkholing of malware domains by a security device via DNS poisoning includes intercepting a DNS query for a network domain from a local DNS server at the security device, in which the network domain was determined to be a bad network domain and the bad network domain was determined to be associated with malware (e.g., a malware domain); and generating a DNS query response to the DNS query to send to the local DNS server, in which the DNS query response includes a designated sinkholed IP address for the bad network domain to facilitate identification of an infected host by the security device.
Claims18
A system, comprising:
- a processor of a cloud security service configured to:
- receive a sample at the cloud security service;
- automatically analyze the sample using the cloud security service to determine whether the sample is associated with malware and to identify one or more bad network domains associated with the malware, comprising to:
- identify a bad network domain that the sample attempts to access;
- determine whether the bad network domain has been registered;
- and
- in response to a determination that the bad network domain has not been registered, register the bad network domain that has not been registered to an IP address associated with a device of the cloud security service or controlled by the cloud security service;
- generate one or more domain name system (DNS) signatures for the one or more bad network domains;
- publish the one or more DNS signatures to automatically distribute the one or more DNS signatures from the cloud security service to a plurality of security devices of customers of the cloud security service to facilitate selective sinkholing of malware domains by the plurality of security devices via DNS poisoning;
- intercept a DNS query for a network domain from a local DNS server at security device, wherein the network domain was determined to be one of the one or more bad network domains;
- and
- generate a DNS query response to the DNS query to send to the local DNS server, wherein the DNS query response includes a time to live (TTL) set to a predetermined period of time, the predetermined period of time being set to a value to allow subsequent queries from local hosts to the local DNS server for the one bad network domain to result in a local DNS server cache miss and corresponding to 1, wherein the DNS query response includes a designated sinkholed IP address for the one bad network domain to facilitate identification of an infected host by the security device, and wherein the DNS query response is a spoofed DNS query response, the spoofed DNS query response including a non-existent IP address, a reserved IP address, or a loopback address;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
11 more elements
A method, comprising:
- receiving a sample at a cloud security service;
- automatically analyzing the sample using the cloud security service to determine whether the sample is associated with malware and to identify one or more bad network domains associated with the malware, comprising:
- identifying a bad network domain that the sample attempts to access;
- determining whether the bad network domain has been registered;
- and
- in response to a determination that the bad network domain has not been registered, registering the bad network domain that has not been registered to an IP address associated with a device of the cloud security service or controlled by the cloud security service;
- generating one or more domain name system (DNS) signatures for the one or more bad network domains;
- publishing the one or more DNS signatures to automatically distribute the one or more DNS signatures from the cloud security service to a plurality of security devices of customers of the cloud security service to facilitate selective sinkholing of malware domains by the plurality of security devices via DNS poisoning;
- intercepting a DNS query for a network domain from a local DNS server at a security device, wherein the network domain was determined to be one of the one or more bad network domains;
- and
- generating a DNS query response to the DNS query to send to the local DNS server, wherein the DNS query response includes a time to live (TTL) set to a predetermined period of time, the predetermined period of time being set to a value to allow subsequent queries from local hosts to the local DNS server for the one bad network domain to result in a local DNS server cache miss and corresponding to 1, wherein the DNS query response includes a designated sinkholed IP address for the one bad network domain to facilitate identification of an infected host by the security device, and wherein the DNS query response is a spoofed DNS query response, the spoofed DNS query response including a non-existent IP address, a reserved IP address or a loopback address.
8 more elements
A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- receiving a sample at a cloud security service;
- automatically analyzing the sample using the cloud security service to determine whether the sample is associated with malware and to identify one or more bad network domains associated with the malware, comprising:
- identifying a bad network domain that the sample attempts to access;
- determining whether the bad network domain has been registered;
- and
- in response to a determination that the bad network domain has not been registered, registering the bad network domain that has not been registered to an IP address associated with a device of the cloud security service or controlled by the cloud security service;
- generating one or more domain name system (DNS) signatures for the one or more bad network domains;
- publishing the one or more DNS signatures to automatically distribute the one or more DNS signatures from the cloud security service to a plurality of security devices of customers of the cloud security service to facilitate selective sinkholing of malware domains by the plurality of security devices via DNS poisoning;
- intercepting a DNS query for a network domain from a local DNS server at a security device, wherein the network domain was determined to be one of the one or more bad network domains;
- and
- generating a DNS query response to the DNS query to send to the local DNS server, wherein the DNS query response includes a time to live (TTL) set to a predetermined period of time, the predetermined period of time being set to a value to allow subsequent queries from local hosts to the local DNS server for the one bad network domain to result in a local DNS server cache miss and corresponding to 1, wherein the DNS query response includes a designated sinkholed IP address for the one bad network domain to facilitate identification of an infected host by the security device, and wherein the DNS query response is a spoofed DNS query response, the spoofed DNS query response including a non-existent IP address, a reserved IP address, or a loopback address.
8 more elements
Dependencies are inferred from the claim text.