Distributed frequency data collection via DNS

Abstract

Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Description

TECHNICAL FIELD

[0001] The present invention relates generally to computer network security and more particularly to enabling detection of widespread “events” which are indicative of network security concerns, such as a distribution of spam or malware (for example, a virus, worm or spyware).BACKGROUND ART

[0002] Along with the many benefits of data and communication exchanges as a result of the Internet, there are significant risks. Providing security for a computer network so as to prevent disruption of network operations is an increasing concern for network administrators. A security measure that has become a standard practice is to use a firewall as a chokepoint for the network. The firewall enforces one or more sets of rules which determine access to and from nodes of the network.

[0003] Firewalls utilize various techniques to provide security for a network. One such technique is packet filtering. The firewall may examine packets to determine origins, destinations and content. All pac...

Images