Asynchronous domain name server resolution with automated classification of domain type

• US 10,015,180 B1
• Filed: 09/23/2016
• Issued: 07/03/2018
• Est. Priority Date: 09/23/2016
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Heuser, Erik M.
• Primary Examiner(s): Le, David
• Application Number:
  US15/274,091
• Time in Patent Office: 648 Days
• Field of Search: None
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Asynchronous techniques are provided for resolving domain names and for automated classification of domain type. An exemplary method comprises asynchronously resolving at least two known domains in parallel to obtain a current domain-to-IP address resolution for the at least two known domains, wherein a schedule of the asynchronous resolution is based on a Time-To-Live attribute of a latest domain-to-IP address resolution of the at least two known domains; determining if the current domain-to-IP address resolution matches the latest domain-to-IP address for the at least two known domains; and updating the domain-to-IP address table with the current domain-to-IP address resolution and corresponding resolution time if the current domain-to-IP address resolution does not match the latest domain-to-IP address for a given known domain. In one or more embodiments, a Time-To-Live attribute of the current domain-to-IP address resolution for the given known domain is updated in the domain table. A plurality of worker processes optionally perform the asynchronous resolution.

Claims

1. A method, comprising:

obtaining a domain table identifying a plurality of known domains;

obtaining a domain-to-IP address table identifying a latest domain-to-IP address resolution and corresponding latest resolution time for a plurality of domains;

asynchronously resolving at least two of said plurality of known domains from said domain table in parallel to obtain a current domain-to-IP address resolution for said at least two known domains, wherein a schedule of said asynchronous resolution is based on a Time-To-Live attribute of said latest domain-to-IP address resolution of said at least two of said plurality of known domains;

determining, using at least one processing device, if said current domain-to-IP address resolution from said asynchronous resolution matches said latest domain-to-IP address for each of said at least two known domains; and

updating, using said at least one processing device, said domain-to-IP address table with said current domain-to-IP address resolution from said asynchronous resolution and said corresponding resolution time for a given one of said at least two known domains if said current domain-to-IP address resolution does not match said latest domain-to-IP address for said given known domain.

2. The method of claim 1, further comprising the step of updating a Time-To-Live attribute of said current domain-to-IP address resolution for said given known domain in said domain table.

3. The method of claim 1, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed by a plurality of worker processes.

4. The method of claim 3, further comprising the step of placing said plurality of worker processes into a random sleep mode based on a number of said plurality of worker processes in order to offset said plurality of worker processes from one another.

5. The method of claim 1, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed on a predefined schedule for each of a plurality of distinct classes of known domains.

6. The method of claim 5, wherein said plurality of distinct classes comprises one or more of a first class of known domains comprising known domains in said domain table having an expired Time-To-Live attribute that are not classified as trusted domains;

a second class of known domains comprising known domains in said domain table that do not have a domain-to-IP address resolution; and

a third class of known domains comprising known domains in said domain table that are classified as trusted domains and satisfy a predefined time criteria.

7. The method of claim 1, further comprising the steps of:

obtaining at least one domain name included in one or more malware domain resolution requests;

obtaining said domain table identifying said plurality of known domains;

obtaining a dynamic domain table identifying a plurality of dynamic Domain Name System domains;

parsing a full domain name associated with said at least one domain name into a Top Level Domain and a Domain;

classifying said at least one domain name as a dynamic Domain Name System domain if said Top Level Domain and said Domain are found in said dynamic domain table; and

storing said classification of said at least one domain name as said dynamic Domain Name System domain in said domain table with a complete domain of said at least one domain, a current date and time and a Time-To-Live attribute of said at least one domain from a response of the Domain Name System.

8. The method of claim 7, further comprising the steps of obtaining a whitelist table identifying a plurality of trusted domains, and classifying said at least one domain name as a trusted domain if said Top Level Domain and said Domain are found in said whitelist table.

9. The method of claim 8, further comprising the step of classifying said at least one domain name as an uncategorized domain if said Top Level Domain and said Domain are not found in said dynamic domain table and said whitelist table.

10. The method of claim 7, further comprising the step of automatically reclassifying said domain and wherein all sub-domains of the domain are re-categorized to match the domain and top level domain of the re-classified domain.

11. The method of claim 7, further comprising the step of monitoring communications of malware to obtain said one or more domain resolution requests.

12. The method of claim 7, further comprising the step of automatically reclassifying a given one of said known domains in said domain table such that all sub-domains of the reclassified known domain are updated to match the Top Level Domain and the Domain of said reclassified known domain.

13. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

obtaining a domain table identifying a plurality of known domains;

obtaining a domain-to-IP address table identifying a latest domain-to-IP address resolution and corresponding latest resolution time for a plurality of domains;

asynchronously resolving at least two of said plurality of known domains from said domain table in parallel to obtain a current domain-to-IP address resolution for said at least two known domains, wherein a schedule of said asynchronous resolution is based on a Time-To-Live attribute of said latest domain-to-IP address resolution of said at least two of said plurality of known domains;

determining if said current domain-to-IP address resolution from said asynchronous resolution matches said latest domain-to-IP address for each of said at least two known domains; and

updating said domain-to-IP address table with said current domain-to-IP address resolution from said asynchronous resolution and said corresponding resolution time for a given one of said at least two known domains if said current domain-to-IP address resolution does not match said latest domain-to-IP address for said given known domain.

14. The computer program product of claim 13, further comprising the step of updating a Time-To-Live attribute of said current domain-to-IP address resolution for said given known domain in said domain table.

15. The computer program product of claim 13, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed by a plurality of worker processes and further comprising the step of placing said plurality of worker processes into a random sleep mode based on a number of said plurality of worker processes in order to offset said plurality of worker processes from one another.

16. The computer program product of claim 13, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed on a predefined schedule for each of a plurality of distinct classes of known domains, wherein said plurality of distinct classes comprises one or more of a first class of known domains comprising known domains in said domain table having an expired Time-To-Live attribute that are not classified as trusted domains;

a second class of known domains comprising known domains in said domain table that do not have a domain-to-IP address resolution; and

a third class of known domains comprising known domains in said domain table that are classified as trusted domains and satisfy a predefined time criteria.

17. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps;

obtaining a domain table identifying a plurality of known domains;

obtaining a domain-to-IP address table identifying a latest domain-to-IP address resolution and corresponding latest resolution time for a plurality of domains;

asynchronously resolving at least two of said plurality of known domains from said domain table in parallel to obtain a current domain-to-IP address resolution for said at least two known domains, wherein a schedule of said asynchronous resolution is based on a Time-To-Live attribute of said latest domain-to-IP address resolution of said at least two of said plurality of known domains;

determining if said current domain-to-IP address resolution from said asynchronous resolution matches said latest domain-to-IP address for each of said at least two known domains; and

updating said domain-to-IP address table with said current domain-to-IP address resolution from said asynchronous resolution and said corresponding resolution time for a given one of said at least two known domains if said current domain-to-IP address resolution does not match said latest domain-to-IP address for said given known domain.

18. The system of claim 17, further comprising the step of updating a Time-To-Live attribute of said current domain-to-IP address resolution for said given known domain in said domain table.

19. The system of claim 17, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed by a plurality of worker processes and further comprising the step of placing said plurality of worker processes into a random sleep mode based on a number of said plurality of worker processes in order to offset said plurality of worker processes from one another.

20. The system of claim 17, wherein said step of asynchronously resolving said at least two of said plurality of known domains is performed on a predefined schedule for each of a plurality of distinct classes of known domains, wherein said plurality of distinct classes comprises one or more of a first class of known domains comprising known domains in said domain table having an expired Time-To-Live attribute that are not classified as trusted domains;

a second class of known domains comprising known domains in said domain table that do not have a domain-to-IP address resolution; and

a third class of known domains comprising known domains in said domain table that are classified as trusted domains and satisfy a predefined time criteria.