Website Security

• US 20160014145A1
• Filed: 09/23/2015
• Published: 01/14/2016
• Est. Priority Date: 10/07/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Sheleheda, Daniel, Amoroso, Edward G., Cama, Cynthia, Feng, Junlan, Leibolt, Gregory, Macwan, Sanjay, O'Hern, William, Torres, Valerie, Yu, Yuhong
• Granted Patent: US 9,825,973 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 65/4025 where none of the additional parallel sessions is real time or time sensitive, e.g. downloading a file in a parallel FTP session, initiating an email or combinational services

Abstract

Websites are monitored for changes over time. A domain name server resolves a domain name to a single internet protocol address and then performs a reverse resolution for the single internet protocol address. When multiple alias records resolve to the same host name, the domain name server determines the single internet protocol address virtually hosts multiple domain names.

Claims

1. A method, comprising:

receiving, by a domain name server, a single internet protocol address;

querying, by the domain name server, a domain name resolution for the single internet protocol address;

retrieving, by the domain name server, a host name having the domain name resolution with the single internet protocol address;

requerying, by the domain name server, the domain name resolution for the host name;

retrieving, by the domain name server, multiple alias records having the domain name resolution with the host name; and

determining, by the domain name server, the single internet protocol address virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the host name.

2. The method of claim 1, further comprising downloading a web page associated with each one of the multiple domain names.

3. The method of claim 2, further comprising generating a first thumbnail image of the web page.

4. The method of claim 3, further comprising storing an electronic association in an electronic database between a filename associated with the first thumbnail image and a time of retrieval associated with the web page.

5. The method of claim 4, further comprising:

redownloading the web page at a later time than the time of retrieval;

generating a second thumbnail image of the web page redownloaded at the later time;

comparing the first thumbnail image to the second thumbnail image; and

determining an image difference between the first thumbnail image and the second thumbnail image.

6. The method of claim 5, further comprising determining a textual difference between the first thumbnail image and the second thumbnail image.

7. The method of claim 6, further comprising visually highlighting the textual difference.

8. A system comprising:

a processor; and

a memory storing code that when executed causes the processor to perform operations, the operations comprising;

receiving a single internet protocol address;

querying a domain name resolution for the single internet protocol address;

retrieving a host name having the domain name resolution with the single internet protocol address;

requerying the domain name resolution for the host name;

retrieving multiple alias records having the domain name resolution with the host name; and

determining the single internet protocol address virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the host name.

9. The system of claim 8, wherein the operations further comprise downloading a web page associated with each one of the multiple domain names.

10. The system of claim 9, wherein the operations further comprise generating a first thumbnail image of the web page.

11. The system of claim 10, wherein the operations further comprise storing an electronic association in an electronic database between a filename associated with the first thumbnail image and a time of retrieval associated with the web page.

12. The system of claim 11, wherein the operations further comprise:

redownloading the web page at a later time than the time of retrieval;

generating a second thumbnail image of the web page redownloaded at the later time;

comparing the first thumbnail image to the second thumbnail image; and

determining an image difference between the first thumbnail image and the second thumbnail image.

13. The system of claim 12, wherein the operations further comprise determining a textual difference between the first thumbnail image and the second thumbnail image.

14. The system of claim 13, wherein the operations further comprise visually highlighting the textual difference.

15. A memory device storing instructions that when executed causes a processor to perform operations, the operations comprising:

identifying, by a domain name server, a port open to a communications network;

identifying, by the domain name server, a single internet protocol address associated with another server that is accessible via the port open to the communications network;

querying, by the domain name server, a domain name resolution for the single internet protocol address;

retrieving, by the domain name server, a host name having the domain name resolution with the single internet protocol address;

requerying, by the domain name server, the domain name resolution for the host name;

retrieving, by the domain name server, multiple alias records having the domain name resolution with the host name;

determining, by the domain name server, the single internet protocol address associated with the another server that is accessible via the port open virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the host name;

identifying, by the domain name server, web pages associated with each one of the multiple domain names virtually hosted by the another server;

downloading, by the domain name server, each one of the web pages associated with each one of the multiple domain names at a first time;

generating, by the domain name server, first thumbnail images of the each one of the web pages;

downloading, by the domain name server, the each one of the web pages associated with each one of the multiple domain names at a second time later than the first time;

generating, by the domain name server, second thumbnail images of the each one of the web pages at the second time;

comparing, by the domain name server, the first thumbnail images to the second thumbnail images;

determining, by the domain name server, an image difference between corresponding ones of the first thumbnail images and the second thumbnail images; and

processing, by the domain name system, the image difference for the display.

16. The memory device of claim 15, wherein the operations further comprise storing electronic associations in an electronic database between filenames associated with the first thumbnail images and the first time.

17. The memory device of claim 15, wherein the operations further comprise storing electronic associations in an electronic database between filenames associated with the second thumbnail images and the second time.

18. The memory device of claim 15, wherein the operations further comprise determining a textual difference between any one of the first thumbnail images and a corresponding one of the second thumbnail images.

19. The memory device of claim 18, wherein the operations further comprise visually highlighting the textual difference.

20. The memory device of claim 15, wherein the operations further comprise identifying all internet protocol addresses that are accessible via the port open to the communications network.