Abstract:
An anti-spyware manager uses domain name service resolution queries to combat spyware. The anti-spyware manager maintains a list of domain names associated with spyware, monitors domain name service queries, and detects queries on domain names on the list. Responsive to detecting a domain name service query on a domain name associated with spyware, the anti-spyware manager forces the domain name service query to resolve to an address not associated with the domain name. Because attempts by spyware to communicate with its home server are now routed to the forced address, the spyware is unable to communicate with its homer server, and thus can neither steal information nor download updates of itself. Additionally, the anti-spyware manager can identify computers that are infected with spyware and clean or quarantine them.

Description:
TECHNICAL FIELD 
   This invention pertains generally to computer security, and more specifically to using domain name service resolution queries to combat spyware. 
   BACKGROUND 
   Spyware (sometimes also known as adware or thiefware) is one of the fastest growing computer security problems today. Enterprises, Internet service providers and home users are all vulnerable to spyware, which installs itself on computers, executes thereon, gathers information about the computer and its user(s) and transmits this ill-gotten information back to a central repository (e.g., a spyware home server). 
   Commercial software exists today which detects known spyware on computers by scanning for identifying signatures. Such software then eliminates detected spyware. However, spyware is often quite sophisticated, and contacts home servers not only to send its stolen information, but also to update itself by downloading newer versions. Not only can the newer versions be more effective at gleaning information, but they can also be engineered to spoof scanning software. Some spyware is so well engineered that it continues to download newer versions from its home server with altered binary layouts, and thus remains undetected by signature based detection systems. 
   What is needed are methods, systems and computer readable media for preventing spyware from communicating to its home servers, thereby preventing both the theft of information and the updating of the spyware itself. It would also be desirable for the methods, systems and computer readable media to be able to identify computers that are infected with spyware. 
   SUMMARY OF INVENTION 
   Computer-implemented methods, computer systems and computer-readable media use domain name service resolution queries to combat spyware. An anti-spyware manager maintains a list of domain names associated with spyware. The anti-spyware manager monitors domain name service queries, and detects queries on domain names on the list. Responsive to detecting a domain name service query on a domain name associated with spyware, the anti-spyware manager forces the domain name service query to resolve to an address not associated with the domain name. Where the monitoring is executed at an enterprise level, the forced address can be that of a honeypot server within the enterprise. Where the monitoring is executed at a local host level, the query is resolved to the IP address of the local host. Because attempts by spyware to communicate with its home server are now routed to the forced address, the spyware is unable to communicate with its homer server, and thus can neither steal information nor download updates of itself. Additionally, the anti-spyware manager can identify computers that are infected with spyware and clean or quarantine them as desired. 
   The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawing, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 

   
     BRIEF DESCRIPTION OF THE DRAWING 
       FIG. 1  is a block diagram illustrating a high level overview of an anti-spyware manager using domain name service resolution queries to combat spyware at an enterprise level, according to some embodiments of the present invention. 
       FIG. 2  is a block diagram illustrating a high level overview of an anti-spyware manager using domain name service resolution queries to combat spyware at a local host level, according to other embodiments of the present invention. 
       FIG. 3  is a block diagram illustrating an anti-spyware manager providing selective blocking of spyware home servers, according to other embodiments of the present invention. 
   

   The Figures depicts embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
   DETAILED DESCRIPTION 
     FIG. 1  illustrates an anti-spyware manager  101  using domain name service (DNS) resolution queries  103  to combat spyware  105  at an enterprise  107  level, according to some embodiments of the present invention. It is to be understood that although the anti-spyware manager  101  is illustrated as a single entity, as the term is used herein an anti-spyware manager  101  refers to a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where an anti-spyware manager  101  is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. Note that in  FIG. 1  the anti-spyware manager  101  is illustrated as residing within the enterprise  107 , but in other embodiments the anti-spyware manager  101  can be located externally from the enterprise  107  as desired. 
   As illustrated in  FIG. 1 , the anti-spyware manager  101  manager maintains a list  109  of domain names  111  associated with spyware  105 . Because spyware home servers  113  tend to have multiple and changing locations, spyware  105  generally knows its home servers  113  by domain name  111  as opposed to Internet Protocol (IP) address  115 . Thus, in order to contact a home server  113 , spyware  105  generally performs a DNS resolution query  103  in order to obtain a working IP address  115  for a home server  113 . 
   The list  109  of domain names  111  associated with spyware  105  can be supplied in whole or in part from a centralized source of computer security data (not pictured), and/or provided by or edited at an enterprise  107  or local level. In any case, domain names  111  used by known spyware  105  can be learned by watching the operation of known the spyware  105 . The domain names  111  gleaned from such observation can then be used within the context of the present invention. For example, when installed on a host computer  112  the known spyware program Adware.Hotbar contacts servers identified by the following domain names  111 : 
   https://www.verisign.com/rpa 
   http://partners.hotbar.com 
   http://hotbar.com 
   https://secure.hotbar.com/secure/HBsubscribe/Store.asp 
   http://crl.verisign.com/pca3.crl0 
   http://crl.verisign.com/Class3CodeSigning2001.crl0 
   http://hotbar.com/license.htm 
   Some of the domain names  111  such as those identifying verisign sites are well known. However others are clearly those of the home servers  113  of the Hotbar Adware program. 
   The anti-spyware manager  101  monitors DNS resolution queries  103 , and detects queries  103  on domain names  111  on the list  109 . When it detects such a query  103 , the anti-spyware manager  101  forces the resolution to an IP address  115  of a computer under its control (e.g., a so called honey-pot server  117  within the enterprise  107 , as illustrated) as opposed to the spyware home server  113  that the spyware  105  is attempting to contact. Thus, future attempts by the spyware  105  to communicate to the home server  113  will be directed to the honeypot server  117 . The implementation mechanics of monitoring DNS resolution queries  103  are known to those of ordinary skill in the relevant art, and the manner in which to apply same within the context of the present invention will be readily apparent to those of such a skill level, in light of this specification. For example, in the illustrated embodiment in which spyware  105  is combated at an enterprise  107  level, the monitoring of DNS queries  103  can be implemented at a DNS Server level. 
   Because the anti-spyware manager  101  forces the DNS resolution queries  103  on spyware home servers  113  to resolve to the IP address  115  of the honeypot server  117 , attempts by the spyware  105  to send stolen information  119  are redirected to the honeypot server  117 . Thus, the information  119  is never obtained by the spyware home server  113 . Additionally, the spyware  105  is not able to download updates of itself, as it is unable to obtain the IP address  115  of a home server  113 , and sends its update requests  121  to the honeypot server instead. 
   When the anti-spyware manager  101  detects an attempt by a host computer  112  within the enterprise  107  to communicate with the IP address  115  to which the resolution of the domain name service query  103  was forced, the anti-spyware manager  101  determines that the host computer  112  that attempted the communication is infected with spyware  105 . The anti-spyware manager  101  can make this conclusion because a process on the host computer  112  is attempting to communicate with a spyware home server  113  (note that the attempt is thwarted by the anti-spyware manager  101 ). 
   In other embodiments, the anti-spyware manager  101  determines that a host computer  112  is infected with spyware  105  responsive to detecting a domain name service query  103  on a domain name  111  on the list  109  of domain names  111  associated with spyware  105  originating from that host computer  112 . When this occurs, a process on the host computer  112  is attempting to glean an IP address  115  for a spyware home server  113 , and thus the anti-spyware manager  101  can conclude that the host computer  112  is infected. 
   When the anti-spyware manager  101  determines that a host computer  112  within the enterprise  107  is infected with the spyware, the anti-spyware manager  101  can take various steps in response, such as quarantining the host  112  to a remediation network (not illustrated), or extensively scanning the host  112  for spyware  105 . Even if the spyware  105  on the host  112  can not be located and removed because its signature is not known, the spyware  105  is prevented from stealing information and updating itself. The anti-spyware manager  101  can continue to download the latest signatures, so as to detect and remove the spyware  105  from the host  112  once a signature for that spyware is available. 
   Turning now to  FIG. 2 , an embodiment of the present invention is illustrated in which the anti-spyware manager  101  combats spyware at a local host level  201  (e.g., on a home user&#39;s personal computer). As with the embodiment illustrated in  FIG. 1 , the anti-spyware manager  101  maintains a list  109  of domain names  111  associated with spyware  105 . The anti-spyware manager monitors DNS resolution queries  103  made by processes  202  on the local host  201 , and detects queries  103  on domain names  111  on the list  109 . The implementation mechanics of monitoring DNS resolution queries  103  at a local host  201  level are known to those of ordinary skill in the relevant art, and the manner in which to apply same within the context of the present invention will be readily apparent to those of such a skill level, in light of this specification. For example, as illustrated this functionality can be implemented by a DNS proxy  203  on the local host  201 . Alternatives include but are not limited to implementation at a network stack level or through the use of hosts.con (not illustrated). 
   When it detects such a query  103 , the anti-spyware manager  101  forces the resolution to the IP address  115  of the local host (e.g., 127.0.0.1). The anti-spyware manager  101  determines a local port  205  on which to listen for attempts to communicate with the spyware home server  113  from the domain name service query  103 . The anti-spyware manager  101  listens to the local host IP address  115  on that port  205 . The anti-spyware manager is thus able to detect attempts by processes  202  on the local host  201  to communicate with spyware home servers  113 . Attempts to transmit data  119  to or request updates  121  from the spyware home server  113  are routed to the IP address  115  of the local host via the local port  205 , and detected by the anti-spyware manager  101 . 
   When the anti-spyware manager  101  detects an attempt by a process  207  on the local host computer  201  to communicate with the local host  201  IP address  115  via the local port  205 , the anti-spyware manager  101  determines that the local host  201  is infected with spyware  105 . In other embodiments, the anti-spyware manager  101  determines that the local host computer  201  is infected with spyware  105  responsive to detecting a process  202  on the local host  201  making a domain name service query  103  on a domain name  111  on the list  109  of domain names  111  associated with spyware  105 . When the anti-spyware manager  101  determines that the local host computer  201  is infected with spyware  105 , the anti-spyware manager  101  can run a spyware removal program on the local host  201 . 
   It is to be understood that domains identified as hosting spyware  105  can also host legitimate services. There are also circumstances under which it is desirable to allow deliberate access to spyware home servers  113  (e.g., the user wishes to view the Hotbar Website). Therefore, as illustrated in  FIG. 3 , in some embodiments of the present invention the anti-spyware manager  101  allows selective communication with one or more known spyware home servers  113 . The selective access can be controlled in a variety of ways as desired. For example, access can be allowed to specific processes only (e.g., a trusted process  301  as illustrated) or blocked for specific processes only (e.g., a browser  303  as illustrated). Also, the user can be informed (e.g., via a graphical user interface) when such attempts are made by some or all processes, and the access can then be blocked or allowed as per the user&#39;s input. In yet other embodiments, various access and blocking policies can be applied as desired, based on factors such as differentiating between user initiated communication activity and automatic activity (e.g. startup items). Of course, selective access can be provided at both enterprise  107  and local host  201  levels. 
   As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, agents, managers, functions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, agents, managers, functions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. In one embodiment, the component is stored in an executable format on a computer readable storage medium and can be executed by a computer. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.