Identifying malware devices with domain name system (DNS) queries
AssigneeComcast Cable Communications, LLC
InventorYiu Leung Lee
Life of this patent
Estimating the term…
Abstract
Various examples described herein are directed to identifying a particular computing device, such as a computing device having malware. A DNS query may be received with a token identifying an originating computing device. The DNS query may be compared to a list of domain names associated with particular characteristics, such as having malware. The token may be used to identify the originating computing device and perform further actions.
Claims46
A computing device comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the computing device to:
- receive, from a user device, a domain name system (DNS) query comprising a domain name;
- append a user device token, comprising information identifying the user device, to the domain name, resulting in a modified DNS query;
- send, to a DNS server, the modified DNS query;
- and
- receive, based on the modified DNS query, an instruction to modify subsequent communications from the user device to include an identifier that indicates the subsequent communications originate from a device potentially infected with malware.
A computing device comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the computing device to:
- receive a domain name system (DNS) query comprising a user device token and a domain name;
- parse the DNS query to identify the user device token and the domain name;
- extract, from the DNS query, the user device token;
- send a reply to the DNS query comprising a network address corresponding to the domain name in the DNS query;
- analyze the domain name to determine a potential threat;
- and
- send, based on a determination that the domain name indicates a potential threat, an instruction to modify subsequent requests from a user device, identified by the user device token, to include an identifier that indicates the subsequent requests originate from a device potentially infected with malware.
A computing device comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the computing device to:
- receive, based on a domain name system (DNS) query, a network address;
- receive an instruction to modify subsequent requests from a user device to include an identifier that indicates the subsequent requests originate from a device potentially infected with malware;
- and
- modify at least one subsequent request from the user device to include the identifier.
One or more non-transitory computer-readable media storing instructions that, when executed, configure a computing device to:
- receive, from a user device, a domain name system (DNS) query comprising a domain name;
- append a user device token, comprising information identifying the user device, to the domain name, resulting in a modified DNS query;
- send, to a DNS server, the modified DNS query;
- and
- receive, based on the modified DNS query, an instruction to modify subsequent communications from the user device to include an identifier that indicates the subsequent communications originate from a device potentially infected with malware.
One or more non-transitory computer-readable media storing instructions that, when executed, configure a computing device to:
- receive a domain name system (DNS) query comprising a user device token and a domain name;
- parse the DNS query to identify the user device token and the domain name;
- extract, from the DNS query, the user device token;
- send a reply to the DNS query comprising a network address corresponding to the domain name in the DNS query;
- analyze the domain name to determine a potential threat;
- and
- send, based on a determination that the domain name indicates a potential threat, an instruction to modify subsequent requests from a user device, identified by the user device token, to include an identifier that indicates the subsequent requests originate from a device potentially infected with malware.
One or more non-transitory computer-readable media storing instructions that, when executed, configure a computing device to:
- receive, based on a domain name system (DNS) query, a network address;
- receive an instruction to modify subsequent requests from a user device to include an identifier that indicates the subsequent requests originate from a device potentially infected with malware;
- and
- modify at least one subsequent request from the user device to include the identifier.
Dependencies are inferred from the claim text.