System and Method to Manage Sinkholes

• US 20140283063A1
• Filed: 07/08/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: FireEye, Inc. (Alphabet Inc.)
• Inventors: Thompson, Matthew, Hijazi, Karim
• Granted Patent: US 9,497,213 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method operable to manage and/or distribute sinkholes.

Claims

1. A method to distribute one or more sinkholes, the method comprising the step of:

transmitting a takedown request to a cooperative registrar of a target domain upon occurrence of an event,

wherein,

the takedown request causes the registrar to perform a zone update to a zone of the target domain, and

the zone update is effective to (i) prevent reception by a first server of one or more records from a second server, and (ii) cause one or more other records to be returned, the one or more other records configured to instruct the first server to contact one or more name servers associated with one or more sinkholes.

2. The method of claim 1, wherein the registrar is previously known to at least one of (i) be a cooperative registrar, and (ii) have authority to make one or more TLD zone file changes for the target domain.

3. The method of claim 1, wherein the zone of the target domain is a top level domain zone.

4. The method of claim 1, wherein the first server is a recursive server.

5. The method of claim 1, wherein the second server is an original authoritative server for the domain.

6. The method of claim 1, wherein the records are glue records received from a TLD name server associated with the second server.

7. The method of claim 1, wherein the one or more sinkholes are one or more sinkhole islands.

8. The method of claim 7, wherein the first server is configured to query a name server of one or more of the one or more sinkhole islands for the domain.

9. The method of claim 7, wherein the first server is configured to consult a database for a record or an IP address for a sinkhole sensor node within the one or more sinkhole islands.

10. The method of claim 9, wherein the record or the IP address for the sinkhole sensor node is returned to a malware via a stub resolver.

11. The method of claim 1, wherein the event is one or more of (i) an occurrence of a public event, (ii) identification of a new malware author or group, (iii) identification of a new malware family, (iv) a component reaching a threshold, and (v) elapse of a predetermined period of time.

12. A system to distribute one or more sinkholes, the system comprising:

a transmitter configured to transmit a takedown request to a cooperative registrar of a domain upon occurrence of an event,

wherein,

the takedown request causes the registrar to perform a zone update to a zone of the target domain, and

the zone update is effective to (i) prevent reception by a first server of one or more records from a second server, and (ii) cause one or more other records to be returned, the one or more other records configured to instruct the first server to contact one or more name servers associated with one or more sinkholes.

13. The system of claim 12, wherein the registrar is previously known to at least one of (i) be a cooperative registrar, and (ii) have authority to make one or more TLD zone file changes for the target domain.

14. The system of claim 12, wherein the zone of the target domain is a top level domain zone.

15. The system of claim 12, wherein the first server is a recursive server.

16. The system of claim 12, wherein the second server is an original authoritative server for the domain.

17. The system of claim 12, wherein the records are glue records from a TLD name server associated with the second server.

18. The system of claim 12, wherein the one or more sinkholes are one or more sinkhole islands.

19. The system of claim 18, wherein the first server is configured to query a name server of one or more of the one or more sinkhole islands for the domain.

20. The system of claim 18, wherein the first server is configured to consult a database for a record or an IP address for a sinkhole sensor node within the one or more sinkhole islands.

21. The system of claim 20, wherein the record or the IP address for the sinkhole sensor node is returned to a malware via a stub resolver.

22. The system of claim 12, wherein the event is one or more of (i) an occurrence of a public event, (ii) identification of a new malware author or group, (iii) identification of a new malware family, (iv) a component reaching a threshold, and (v) elapse of a predetermined period of time.