Patent ID: 8775604
Filing Date: 2014-07-08
Classification: H04L

Abstract:
1. A method for operating a server at a remote site of a central security provider to receive DNS requests, wherein at least some of said DNS requests include a plurality of hashes separated by a symbol, the method comprising: receiving from a plurality of independent networks that are enabled to exchange data with said central security provider, using a same algorithm to generate identical hashes upon each occurrence of transfer of identical blocks of data, a unique Domain Name System (DNS) request, each unique DNS request comprising a plurality of non-random indicators that is specifically related to contents of each transfer of a block of data that is an unambiguous result of applying an algorithm to each block of data whereby a second transfer of an identical block of data through at least one of a plurality of network nodes results in the same hash, and includes a count value for each transfer of an identical block of data, and a unique label which prevents DNS caching, whereby occurrence of transfer of an identical block of data a plurality of times is distinguished from the same plurality of occurrences of transfer of blocks of data which never repeat; dissecting a DNS request in order to identify each hash within an aggregated DNS request, determining frequencies of transfer of each block of data which occur in email receptions at the plurality of network nodes; and responding to a DNS request with a DNS response which provides instructions to initiate blocking actions and email disposition at the plurality of network nodes.