Dns based infection scores
AssigneeHewlett Packard Enterprise Development LP
InventorPratyusa K Manadhata
Life of this patent
Estimating the term…
Abstract
Systems and methods associated with domain name system (DNS) based infection scores. One example method includes maintaining query profiles for members of a set of clients in a network. The query profiles may be maintained based on DNS queries sent from the members of the set of clients, and on DNS responses received by the members of the set of clients. The method also includes generating infection scores for the members of the set of clients based on their respective query profiles. The method also includes prioritizing a vulnerable member of the set of clients for remedial action. The vulnerable member may be prioritized based on infection scores of members of the set of clients.
Claims15
A non-transitory computer-readable medium storing computer-executable instructions that when executed by a computer cause the computer to:
- maintain query profiles for members of a set of clients in a network based on domain name system (DNS) queries sent from the members of the set of clients and DNS responses received by the members of the set of clients;
- generate infection scores for the members of the set of clients based on their respective query profiles;
- and
- prioritize a vulnerable member of the set of clients for remedial action based on infection scores of members of the set of clients.
An domain name system (DNS) based infection scoring system, comprising:
- a data store to store DNS query profiles associated with members of a set of clients protected by the DNS based infection scoring system;
- an observation logic to perform real time updating of the DNS query profiles based on DNS queries sent from members of the set of clients and DNS responses received by the members of the set of clients;
- an infection score generation logic to generate weighted infection scores for members of the set of clients based on their respective DNS query profiles;
- and
- a prioritization logic to cause a remedial action to be performed on a member of the set of clients having a highest weighted infection score.
A method, comprising:
- inspecting domain name system (DNS) packets sent from a client and received by the client for attributes that indicate a suspicion level of the client, where the client is a member of a set of clients in a network protected by the computer;
- collecting the attributes over time into a query profile associated the client;
- comparing the query profile against control profiles to generate an infection score for the client;
- and
- scheduling the client for a remedial action when the infection score of the client has a high infection score, when compared against infection scores of other members of the set of clients, taking into account sensitivity levels of the members of the set of clients.
Dependencies are inferred from the claim text.