Patent ID: 8321551
Filing Date: 2012-11-27
Classification: H04L

Abstract:
1. A computer implemented method for using aggregated DNS information originating from a plurality of computers to detect anomalous DNS name resolutions, the method comprising the steps of: receiving, by a server DNS security component running on a server computer, multiple transmissions of DNS information from a plurality of computers, each transmission of DNS information comprising information concerning a specific instance of a resolution of a specific DNS name; aggregating, by the server DNS security component running on the server computer, received multiple transmissions of DNS information from the plurality of computers; comparing, by the server DNS security component running on the server computer, DNS information received from a specific computer concerning a specific DNS name to aggregated DNS information received from multiple computers concerning the same DNS name; determining, by the server DNS security component running on the server computer, whether the DNS information received from the specific computer concerning the specific DNS name is anomalous, responsive to comparing the DNS information received from the specific computer concerning the specific DNS name to the aggregated DNS information received from multiple computers concerning the same DNS name; responsive to a lack of aggregated DNS information received from multiple computers concerning multiple resolutions of a specific DNS name, isolating, by the server DNS security component running on the server computer, a higher level portion of the specific DNS name; and comparing, by the server DNS security component running on the server computer, DNS information received from a specific computer concerning a specific DNS name to aggregated DNS information received from multiple computers concerning the isolated higher level portion of the specific DNS name.