Using aggregated DNS information originating from multiple sources to detect anomalous DNS name resolutions

At least one non-transitory computer readable-storage medium for providing DNS information to a server computer to detect anomalous DNS name resolutions, the at least one non-transitory computer readable-storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to perform the following steps:

• identifying, by a DNS security component running on a computer, attempts to resolve DNS names by at least one specific computer;
• gleaning, by the DNS security component running on the computer, DNS information concerning identified attempts to resolve DNS names by the at least one specific computer;
• transmitting, by the DNS security component running on the computer, gleaned DNS information concerning each identified resolution of a DNS name by the at least one specific computer, to a server DNS security component running on a remote computer;
• receiving, by the DNS security component running on the at least one specific computer, an indication that the DNS information concerning a specific attempt to resolve a specific DNS name by the at least one specific computer is anomalous, from the server DNS security component running on the remote computer to which gleaned DNS information is transmitted;
• and
• responsive to the receiving step, modifying, by the DNS security component running on the at least one specific computer, a resolution of the specific DNS name indicated as being anomalous.

A computer system for providing DNS information to a server computer to detect anomalous DNS name resolutions, the computer system comprising:

• system memory;
• a DNS resolution identifying module residing in the system memory, the DNS resolution identifying module being programmed to identify attempts to resolve DNS names by the computer system;
• a DNS local information gleaning module and a DNS remote information gleaning module residing in the system memory, the DNS local information gleaning module and the DNS remote information gleaning module being programmed to glean DNS information concerning identified attempts to resolve DNS names by the computer system;
• and
• a DNS information transmitting module residing in the system memory, the DNS information transmitting module being programmed to transmit gleaned DNS information concerning each identified resolution of a DNS name by the computer system, to a server DNS security component running on a remote computer;
• wherein the DNS remote information gleaning module is further programmed to receive an indication that the DNS information concerning a specific attempt to resolve a specific DNS name by the computer system is anomalous, from the server DNS security component running on the remote computer to which gleaned DNS information is transmitted, and in response to modify a resolution of the specific DNS name indicated as being anomalous.