Malignant BOT confrontation method and its system

• US 8,112,804 B2
• Filed: 01/08/2008
• Issued: 02/07/2012
• Est. Priority Date: 07/08/2005
• Status: Active Grant

• Current Assignee: KT Corporation
• Original Assignee: KT Corporation
• Inventors: KWON, YOUNG KWAN, OH, SE MAN, LEE, SANG YOUB, HAN, GYU KWEON, JEONG, JU HWAN, Oh, Seung Tak
• Primary Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US11/971,118
• Publication Number:
  US 20080155694A1
• Time in Patent Office: 1,491 Days
• Field of Search: 726 22- 25, 370/352, 709/244, 709/245
• US Class Current: 726/23
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method for dealing with attacks of malicious BOTs in a network security system includes detecting and analyzing a domain name receiving excessive DNS queries to judge the infection of a malicious BOT, registering the corresponding domain name as normal or abnormal management target, and redirecting an abnormal DNS query for the abnormal management target to a redirection processing & response system. Thereby, the automatic detection of malicious BOT attacks and the mechanism which performs the measures and the analysis simultaneously can protect the DNS servers and prevent the security accidents by malicious BOT attacks previously.

Claims

1. A malicious BOT measures method comprising the steps of:

detecting excessive Domain Name System (DNS) queries generated by compromised PC through malicious BOT;

analyzing these queries to classify into normal or abnormal management target; and

redirecting the abnormal DNS query registered as a management target to a redirection processing &

response system, wherein the redirecting step includes the steps of;

changing a destination address of the abnormal DNS query, into the redirection processing &

response system;

generating a response to the abnormal DNS query in the redirection processing &

response system; and

transmitting the response to the compromised PC by malicious BOT, wherein the response generated from the generating step has one of a loop-back address preset by a network administrator and an address of honey pot system for the intrusion temptation and the analysis of malicious BOT characteristics.

2. The malicious BOT measures method according to claim 1, wherein the detecting step includes collecting DNS query packets to detect whether the amount of the queries about specific domain name exceeds a preset threshold value.

3. The malicious BOT measures method according to claim 1, wherein the response generated from the generating step has the same source IP address as that of a response to the normal DNS query.

4. A malicious BOT measures system comprising:

a redirection processing system for analyzing and identifying a domain name to receive receiving excessive Domain Name System (DNS) queries, registering the domain name as normal or abnormal management target and redirecting the abnormal DNS query for a domain name registered as the abnormal management target to a redirection processing &

response system; and

the redirection processing &

response system for generating a response to the abnormal DNS query, wherein the redirection processing system changes the destination address of an abnormal DNS query into the address of the redirection processing &

response system to redirect the abnormal DNS query, and wherein the redirection processing &

response system generates the response to the abnormal DNS query which has a loop-back address or an address of honey pot system for the intrusion temptation and the analysis of malicious BOT characteristics depending on the configuration set by an administrator.

5. The malicious BOT measures system according to claim 4, wherein the redirection processing &

response system generates the response to the abnormal DNS query which has the same IP address as that of a response to a normal DNS query.