Patent ID: 11943196
Assignee: HYAS INFOSEC INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 7:
8. An apparatus for a Domain Name System (DNS) resolver, the apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
determine first characteristics of nameservers properly associated with a domain name;
generate a first hash of the nameservers;
generate nameserver criteria associated with the domain name based on the first characteristics, wherein the nameserver criteria defines whether the first characteristics are those of a suspect nameserver for the domain name;
receive a request to resolve a network address corresponding to the domain name included in the request by a requesting system;
in response to receiving the request:
identify current nameservers for the domain name;
generate a second hash of the current nameservers;
in response to determining the first hash does not match the second hash, determine second characteristics of the current nameservers;
determine that at least one of the current nameservers is suspect based on application of the nameserver criteria to the second characteristics; and
prevent the at least one of the current nameservers from being used to resolve the request in response to determining that the at least one of the current nameservers is suspect.