System and method for selectively collecting computer forensic data using DNS messages

Abstract

The described systems and methods allow for selective collection of computer security data from client devices, such as personal computers, smartphones, and Internet of Things (IoT) devices. A security application executing on each client device includes a domain name service (DNS) agent that marks outgoing DNS messages with a client ID. The DNS server selects a client for data collection by returning a DNS response including a service activation flag. Some embodiments thus enable per DNS message selectivity for data collection. In some embodiments, subsequent network access requests made by the selected client are rerouted to a secure server for analysis.

Description

Background technique [0001] The present invention relates to systems and methods for combating malware, and in particular to selectively collecting network traffic samples for forensic analysis. [0002] Malicious software (also known as malware) affects a large number of computer systems throughout the world. In its many forms (such as computer viruses, Trojan horses, spyware, and ransomware), malware poses a serious risk to millions of computer users, making them vulnerable to loss of data and sensitive information, identity theft, and loss of production efficiency etc. [0003] A wide variety of devices, informally referred to as the Internet of Things (IoT), are increasingly connected to communication networks and the Internet. Such devices include smartphones, smart watches, televisions and other multimedia devices, game consoles, home appliances, and various household sensors such as thermostats, among others. As more such devices come online, they become exposed to s...

AI Technical Summary

Problems solved by technology

However, criminal devices are not easily identified in the presence of unknown threats

Images