Real time management of botnet attacks

A computer network monitoring system for monitoring a protected computer network for managing botnet attacks from within the protected computer network, the computer network monitoring system comprising a name server, the name server comprising:

• a memory configured to store instructions;
• a processor disposed in communication with the memory, wherein the processor, upon execution of the instructions is configured to:
• receive a DNS request included in network traffic internal to the protected computer network from a source host included in the protected computer network, each DNS request included in the network traffic including a domain name of a target host and identifying a source address of the source host, wherein translation of the domain name provides an IP address of the source host;
• compare the domain name of the DNS request to a botnet domain repository, the botnet domain repository including one or more entries, each entry having a confirmation indicator set to confirmed to indicate that the entry is confirmed or set to tentative to indicate that the entry is tentative;
• if determined by the comparison that the domain name of the DNS request is included in the botnet domain repository, then:
• store or update the source address of the DNS request in an infected host repository, wherein each source address stored in the infected host repository identifies a host known to be infected;
• and
• output a control signal to a network controller to cause the network controller to cause any future network traffic to or from the source address to be diverted to an administrator configured address;
• if determined by the comparison that the domain name is not included in the botnet domain repository, then determine by a second comparison whether the source address of the DNS request is included in the infected host repository;
• and
• if determined by the second comparison that the source address of the DNS request is included in the infected host repository, then store the domain of the DNS request in the botnet domain repository having an associated confirmation indicator set to indicate that the source address is tentative, after which the DNS request is allowed to be handled for further processing as intended by the DNS request.