Detecting botnets
AssigneeCisco Technology, Inc.
InventorsChui-Tin Yen, Saumyavapuh Lugani, Snigdhendu Mukhopadhyay, Kuntal Daftary
Life of this patent
Estimating the term…
Abstract
A method is disclosed for distributed detection of botnets via a plurality of sensors on a network. According to embodiments, DNS information, including domain names and addresses, is received at a sensor, the number of unique subnets corresponding to a domain name is determined and an alert is sent to other sensors when the number of unique subnets exceeds a first threshold. Other embodiments are also disclosed.
Claims24
A method comprising:
- receiving, at a first sensor, first domain name system (DNS) information including one or more first internet protocol (IP) addresses corresponding to a first domain name;
- determining a first number of unique subnets which are based on the one or more first IP addresses and which are unique in all subnet classes;
- sending, to one or more other sensors, a first alert that includes the first DNS information when the first number of unique subnets exceeds a first threshold;
- wherein the method is performed by one or more processors.
A non-transitory computer-readable medium storing one or more sequences of instructions that, when executed by one or more processors, causes the processors to perform:
- receiving, at a first sensor, first domain name system (DNS) information including one or more first internet protocol (IP) addresses corresponding to a first domain name;
- determining a first number of unique subnets which are based on the one or more first IP addresses and which are unique in all subnet classes;
- sending, to one or more other sensors, a first alert that includes the first DNS information when the first number of unique subnets exceeds a first threshold.
An apparatus comprising:
- one or more processors;
- an information acquisition module configured to receive, at a first sensor, first domain name system (DNS) information including one or more first internet protocol (IP) addresses corresponding to a first domain name;
- a subnet analyzer module configured to determine a first number of unique subnets which are based on the one or more first IP addresses and which are unique in all subnet classes;
- an address distribution module configured to send, to one or more other sensors, a first alert that includes the first DNS information when the first number of unique subnets exceeds a first threshold.
Dependencies are inferred from the claim text.