Detection of domain name system hijacking
AssigneeAvast Software s.r.o.
InventorsDmitriy Kuznetsov, Martin Smarda, Pavel Sramek
Life of this patent
Estimating the term…
Abstract
Detecting a Domain Name Service (DNS) hijacking includes resolving names in a hijack target group list to their respective Internet Protocol (IP) addresses. In response to determining that two names in the hijack target group list resolved to a common IP address, a determination is made whether a legitimate reason exists for the two names in the hijack target group list to resolve to the common IP address. In response to determining that a legitimate reason does not exist for the two names in the hijack target group list to resolve to a common IP address, a DNS hijacking is indicated.
Claims9
A computer-implemented method for detecting a Domain Name Service (DNS) hijacking, the computer-implemented method comprising the steps of:
- resolving domain names in a hijack target group list to Internet Protocol (IP) addresses;
- determining, based on the resolving of domain names in the hijack target group list, whether two domain names in the hijack target group list resolved to a common IP address;
- in response to determining that two domain names in the hijack target group list resolved to the common IP address, determining whether a legitimate reason exists for the two domain names in the hijack target group list to resolve to the common IP address;
- and
- in response to determining that a legitimate reason does not exist for the two domain names in the hijack target group list to resolve to the common IP address, indicating a DNS hijacking has occurred.
A computer-implemented method for protecting a malicious Domain Name Service (DNS) hijacking, the computer-implemented method comprising the steps of:
- allowing a computing device to issue queries for Internet Protocol (IP) addresses associated with domain names, the computing device being coupled with a network security scanner having first domain name group list;
- resolving the domain names in the first domain name group list;
- determining, based on the resolving of domain names in the first domain name group list, whether two domain names in the first domain name group list resolved to a common IP address;
- in response to determining that two domain names in the first domain name group list resolved to the common IP address, determining whether a legitimate reason exists for the two domain names in the first domain name group list to resolve to the common IP address, including determining if the two domain names resolved to the common IP address belong to a same subgroup;
- in response to determining that a legitimate reason does not exist for the two domain names in the first domain name group list to resolve to the common IP address, indicating a DNS hijacking has occurred.
A non-transitory computer readable storage medium having a program stored thereon, the program causing the computer to execute the steps of:
- resolving domain names in a first domain name group list to Internet Protocol (IP) addresses;
- determining, based on the resolving of domain names in the first domain name group list, whether two domain names in the first domain name group list resolved to a common IP address;
- in response to determining that two domain names in the first domain name group list resolved to the common IP address, determining whether a legitimate reason exists for the two domain names in the first domain name group list to resolve to the common IP address;
- and
- in response to determining that a legitimate reason does not exist for the two domain names in the first domain name group list to resolve to the common IP address, indicating a Domain Name Service (DNS) hijacking has occurred.
Dependencies are inferred from the claim text.