Distributed frequency data collection via DNS

Abstract

Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

Description

TECHNICAL FIELD[0001]The present invention relates generally to computer network security and more particularly to enabling detection of widespread “events” which are indicative of network security concerns, such as a distribution of spam or malware (for example, a virus, worm or spyware).BACKGROUND ART[0002]Along with the many benefits of data and communication exchanges as a result of the Internet, there are significant risks. Providing security for a computer network so as to prevent disruption of network operations is an increasing concern for network administrators. A security measure that has become a standard practice is to use a firewall as a chokepoint for the network. The firewall enforces one or more sets of rules which determine access to and from nodes of the network.[0003]Firewalls utilize various techniques to provide security for a network. One such technique is packet filtering. The firewall may examine packets to determine origins, destinations and content. All pac...

AI Technical Summary

Benefits of technology

[0017]While the invention has been described primarily with reference to collecting data for purposes of network security, the use of DNS requests as reporting vehicles for data collection may be used in other applications. At each of a number of different nodes, information that is determined to be relevant to the data collection is embedded within a DNS request in a format consistent with the protocol for transmissions. Unlike other DNS requests transmitted from the nodes, the information-reporting DNS requests are forwarded for purposes of enabling the data collection. An advantage of the use of DNS requests as the reporting vehicles is that the transfer of information is less likely to be blocked by rules applied at network security devices, such as chokepoint firewalls. As previously described, there may be a need to incorporate a unique feature into the DNS requests from a particular node, so that the DNS requests are not satisfied by operation of a local DNS server. Merely as two possibilities, the unique feature may be a time (date) stamp or may be an incremented count for duplicate DNS requests from the particular node.

Problems solved by technology

The potential blocking of useful report information occurs because a wide range of different security rules are applied by different independent networks and even by different security devices within a single network.

Images