Using aggregated DNS information originating from multiple sources to detect anomalous DNS name resolutions

Abstract

A DNS security system collects and uses aggregated DNS information originating from a plurality of client computers to detect anomalous DNS name resolutions. A server DNS security component receives multiple transmissions of DNS information from a plurality of client computers, each transmission of DNS information concerning a specific instance of a resolution of a specific DNS name. The server component aggregates the DNS information from the multiple client computers. The server component compares DNS information received from a specific client computer concerning a specific DNS name to aggregated DNS information received from multiple client computers concerning the same DNS name to identify anomalous DNS name resolutions. Where an anomaly concerning received DNS information is identified, a warning can be transmitted to the specific client computer from which the anomalous DNS information was received.

Description

technical field [0001] The present disclosure relates generally to computer security, and more particularly to detecting anomalous DNS name resolution using aggregated DNS information from multiple sources. Background technique [0002] Malicious parties use many different types of Domain Name Service ("DNS") attacks to unwittingly direct users to malicious servers. Attacks such as DNS buffer poisoning, fast pass and double pass techniques, local master file modification, local WinSock / WinInet proxy configuration modification, and others are used to modify attempts to resolve legitimate hostnames in order to redirect resolutions to malicious servers. In many cases, it is difficult for client-based security software to detect that client DNS records have been manipulated. In fact, many DNS attacks are not local to the client and thus cannot actually be addressed on that client alone. On the other hand, many DNS attacks are local to individual clients and thus not easily add...

AI Technical Summary

Problems solved by technology

In many cases, it is difficult for client-based security software to detect that client DNS records have been manipulated

In practice, many DNS attacks are not local to the client, and thus cannot actually be addressed on that client alone

On the other hand, a lot of DNS attacks are local to individual clients and thus not easily addressable by network security solutions alone

Images