Method and system for providing DNS security using process information
AssigneePalo Alto Networks, Inc.
InventorsZihang Xiao, Zhanhao Chen
Life of this patent
Estimating the term…
Abstract
Domain Name System (DNS) security using process information is provided. An application accessing an internet service using a domain name is determined. Process information associated with the application along with an associated DNS query to identify an IP address associated with the domain name are identified. The process information and the associated DNS query to a DNS security service are sent. An action based on a response from the DNS security service is performed.
Claims13
A system, comprising:
- a memory;
- and
- a processor coupled to the memory and configured to:
- receive process information associated with an application along with an associated Domain Name System (DNS) query to identify an IP address associated with a domain name associated with the application, wherein the application is accessing an Internet service using the domain name;
- send the process information and the associated DNS query to a DNS security service;
- and
- perform an action based on a response from the DNS security service, comprising to:
- determine whether the process information is related to a newly registered domain and the process information is related to a system process;
- and
- in response to a determination that the process information is related to the newly registered domain and the process information is related to the system process, block or sinkhole the associated DNS query.
A method, comprising:
- receiving, using a processor, process information associated with an application along with an associated Domain Name System (DNS) query to identify an IP address associated with a domain name associated with the application, wherein the application is accessing an Internet service using the domain name;
- sending, using the processor, the process information and the associated DNS query to a DNS security service;
- and
- performing, using the processor, an action based on a response from the DNS security service, comprising:
- determining whether the process information is related to a newly registered domain and the process information is related to a system process;
- and
- in response to a determination that the process information is related to the newly registered domain and the process information is related to the system process, blocking or sinkholing the associated DNS query.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving process information associated with an application along with an associated Domain Name System (DNS) query to identify an IP address associated with a domain name associated with the application, wherein the application is accessing an Internet service using the domain name;
- sending the process information and the associated DNS query to a DNS security service;
- and
- performing an action based on a response from the DNS security service, comprising:
- determining whether the process information is related to a newly registered domain and the process information is related to a system process;
- and
- in response to a determination that the process information is related to the newly registered domain and the process information is related to the system process, blocking or sinkholing the associated DNS query.
Dependencies are inferred from the claim text.