Patent ID: 8806626

Claim:
A computer implemented method for providing DNS information to a server computer to detect anomalous DNS name resolutions, the method comprising the steps of: identifying, by a DNS security component running on a computer, attempts to resolve DNS names by at least one specific computer; gleaning, by the DNS security component running on the computer, DNS information concerning identified attempts to resolve DNS names by the at least one specific computer; transmitting, by the DNS security component running on the computer, gleaned DNS information concerning each identified resolution of a DNS name by the at least one specific computer, to a server DNS security component running on a remote computer; receiving, by the DNS security component running on the at least one specific computer, an indication that the DNS information concerning a specific attempt to resolve a specific DNS name by the at least one specific computer is anomalous, from the server DNS security component running on the remote computer to which gleaned DNS information is transmitted; and responsive to the receiving step, modifying, by the DNS security component running on the at least one specific computer, a resolution of the specific DNS name indicated as being anomalous.