System and method for detecting and mitigating DNS spoofing trojans
AssigneeEMC Corporation
InventorsAmit Klein, Zohar Golan
Life of this patent
Estimating the term…
Abstract
Embodiments of the present invention relate to a method and system for detecting and/or mitigating domain name system (DNS) spoofing Trojan horse (or Trojan) code. Trojan code (sometimes called malware or malicious software) is a common computer security problem. Some Trojans modify the DNS resolution mechanism employed by the infected computer, such that the computer traffic, when browsing the Internet, is routed to a location not intended by the rightful owner of the computer. The present invention can detect this phenomenon from a remote device or location and may take action to mitigate its effects.
Claims50
A method for detecting spoofing, the method comprising:
- receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname;
- detecting whether the requested IP address matches the desired hostname;
- and
- if said requested IP address does not match said hostname, then:
- obtaining a correct IP address associated with said desired hostname;
- and
- directing said browser application to said correct IP address.
A method comprising:
- receiving a notification of a request sent by a browser application of a client computer to a network address, said request being associated with a requested network address and a desired hostname;
- detecting whether the requested network address matches the desired hostname;
- and
- if said requested network address does not match said hostname, then:
- obtaining a correct network address associated with said desired hostname;
- and
- directing said browser application to said correct network address.
A computer system comprising:
- a server computer including an analyzer processor to receive notification of an IP request originated by a browser application operating on a client computer, said IP request being associated with a requested IP address and a desired hostname, and to detect whether the requested IP address matches the desired hostname;
- wherein if said requested IP address does not match said hostname, then said server is to:
- obtain a correct IP address associated with said desired hostname;
- and
- direct said browser application to said correct IP address.
A method comprising:
- receiving at a computing device a notification of a request originated by a browser application, said request including a physical address of a computing element being associated with a requested physical address and logical address;
- and
- determining whether said requested physical address matches the logical address;
- wherein if said requested physical address does not match said logical address, then said computing device is to:
- obtain a correct physical address associated with said logical address;
- and
- direct said browser application to said correct physical address.
A method for detecting spoofing, the method comprising:
- receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname;
- detecting whether the requested IP address matches the desired hostname;
- and
- if said IP address does not match said hostname, notifying an entity in control of a network in which the IP request was transferred.
A method for detecting spoofing, the method comprising:
- receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname wherein said IP request is made by a subscriber;
- detecting whether the requested IP address matches the desired hostname, wherein if said IP address does not match said hostname, further comprising:
- obtaining a correct IP address associated with said desired hostname.
Dependencies are inferred from the claim text.