IP-Based Malware Blocking via Domain and Address Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional domain-based blocking methods are ineffective against malware as attackers frequently change domains, making it difficult for security software to prevent malicious software downloads, as they often resolve to the same IP addresses, evading traditional security measures.
Innovation Solution
A method that involves receiving hosting website data reports containing domain names and IP addresses, determining if the domain is on a trusted list and if the IP address is on a list of known malware distributors, generating file download control data to block downloads from untrusted domains hosted at repeat-offender IP addresses, and reporting this data to clients to selectively block malicious file downloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional domain-based blocking methods are used, then domain identification is simple, but malware distribution is not effectively blocked due to frequent domain changes
Solution Approach 1:
The patent segments the domain identification process into two independent components: domain name checking and IP address checking. By separating these functions, the system can block malware based on IP addresses even when domain names change frequently, thus resolving the contradiction between reliable malware blocking and adapting to domain changes.
Solution Approach 2:
The patent introduces IP addresses as an intermediary identifier that remains stable even when domain names change. This intermediary allows the security system to maintain effective malware blocking without being affected by frequent domain changes, as the IP address serves as a consistent target for blocking.
2Reliability
If IP address-based blocking is implemented, then malware distribution from known IPs is blocked, but the system complexity increases due to maintaining multiple lists
Solution Approach 1:
The patent creates a unified security system that performs both domain-based and IP-based blocking functions through a single mechanism. The security software maintains multiple lists (trusted domains, suspicious domains, malicious IPs) but uses a universal blocking framework that handles all list types consistently, reducing overall system complexity despite the multi-functional requirement.
3Measurement precision
If multiple blocking lists are maintained, then malware detection accuracy improves, but the processing time increases
Solution Approach 1:
The patent pre-organizes blocking data into structured lists (trusted domains, suspicious domains, malicious IP addresses) before they are needed for blocking decisions. This preliminary organization allows for efficient lookup and comparison during actual download operations, maintaining high detection accuracy while minimizing processing time during critical blocking moments.
Data Source
AI summary
A security module on a client monitors file download activities at the client and reports hosting website data to a security server. A download analysis module at the security server receives a hosting website data report from the client, where the hosting website data report describes a domain name and an IP address of a website hosting a file the client is attempting to download. The download analysis module analyzes the domain name and IP address of the website to generate file download control data indicating whether to allow downloading of the file to the client. The download analysis module reports the file download control data to the security module of the client. The security module uses the file download control data to selectively block downloading of the file.