Method and apparatus for disrupting the command and control infrastructure of hostile programs

• US 8,869,268 B1
• Filed: 10/24/2007
• Issued: 10/21/2014
• Est. Priority Date: 10/24/2007
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Barger, Richard
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US11/864,699
• Time in Patent Office: 2,554 Days
• Field of Search: 726/14, 726 22- 25, 709/217, 709/224, 709/225
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A method and apparatus for securing a computer is described. The method and apparatus comprise detecting one or more hostile programs residing upon a computer using a command and control infrastructure library and disrupting a command and control infrastructure of the one or more hostile programs.

Claims

1. A method for securing a computer, comprising:

transmitting, by the computer, suspect command and control data to a control center, wherein

the suspect command and control data includes a reference to a domain name server (DNS) service, and

the control center is configured to

analyze the suspect command and control data, and

update a command and control infrastructure library, if the suspect command and control data is identified as hostile;

detecting by the computer, a hostile program stored on the computer, wherein

the hostile program is identified by detecting that the reference to the DNS service in the suspect command and control data matches information in the command and control infrastructure library,

the detecting the reference to the DNS service in the suspect command and control data is performed prior to the suspect command and control data being submitted to a DNS server,

the hostile program is configured to be controlled by a hostile command and control infrastructure, and

the hostile command and control infrastructure is associated with a hostile computer; and

disrupting by the computer, the hostile command and control infrastructure, wherein

the disrupting comprises impairing communication with the hostile program.

2. The method of claim 1, further comprising:

creating the command and control infrastructure library, if the suspect command and control data is identified as hostile.

3. The method of claim 2, wherein the creating comprises identifying at least one of

a domain name,

an internet protocol address, or

a machine access code address that forms the portion of a hostile command and control infrastructure.

4. The method of claim 2, wherein the disrupting further comprises disrupting a connection between the hostile program and the hostile computer.

5. The method of claim 4, wherein the disrupting, by the computer, further comprises disrupting a request for the DNS service related to a domain name within the command and control infrastructure library.

6. The method of claim 5, wherein the disrupting, by the computer, further comprises polling cached information for the request for the DNS service related to the domain name within the command and control infrastructure library.

7. The method of claim 5, wherein the disrupting, by the computer, further comprises rejecting the request for the DNS service related to the domain name within the command and control infrastructure library.

8. The method of claim 5, wherein

the disrupting, by the computer, further comprising establishing a plurality of unacceptable domain names,

the plurality of unacceptable domain names comprises

at least one domain name within the command and control infrastructure library, and

comparing the request for the DNS service to the plurality of unacceptable domain names.

9. The method of claim 5, wherein the disrupting, by the computer, further comprises

monitoring at least one DNS query;

and

detecting that the DNS query is related to a domain within the command and control infrastructure library.

10. The method of claim 9, wherein the disrupting, by the computer, further comprises preventing transmission of the DNS query from the computer to the DNS server.

11. The method of claim 9, wherein the disrupting, by the computer, further comprises preventing transmission of a response to the DNS query from the DNS server to the computer.

12. The method of claim 1, further comprising creating an activity-based signature for the hostile program.

21. The method of claim 1, wherein

the suspect control and command data comprises a DNS query,

the detecting, by the computer, further comprises

the computer detecting that the reference to the DNS service in the DNS query matches the information in the command and control infrastructure library, and

the computer detecting the reference to the DNS service in the DNS query is performed prior to the DNS query being submitted to the DNS server.

22. The method of claim 21, wherein

the suspect control and command data further comprises data of a DNS cache, and

the detecting, by the computer, further comprises

the computer detecting that the reference to the DNS service in the data of the DNS cache matches the information in the command and control infrastructure library.

23. The method of claim 1, wherein

the reference to the DNS service indicates the DNS service is being performed using the DNS server.

24. The method of claim 1, wherein

the hostile computer and the computer are separate computers, and

the hostile computer and the computer are communicatively coupled together via a network.

13. An apparatus comprising:

a non-transitory computer-readable memory; and

a processor coupled to the non-transitory computer-readable memory, wherein

the processor is configured to

transmit suspect command and control data to a control center, wherein

the suspect command and control data includes a reference to a domain name server (DNS) service, and

the control center is configured to

 

analyze the suspect command and control data, and

 

update a command and control infrastructure library, if the suspect command and control data is identified as hostile;

detect a hostile program stored on the non-transitory computer-readable memory, wherein

the hostile program is identified by detecting that the reference to the DNS service in the suspect command and control data matches information in the command and control infrastructure library,

the processor is configured to perform the detecting the reference to the DNS service in the suspect command and control data prior to the command and control data being submitted to a DNS server,

the hostile program is configured to be controlled by a hostile command and control infrastructure, and

the hostile command and control infrastructure is associated with a hostile computer; and

disrupt the hostile command and control infrastructure, wherein

the disrupting the hostile command and control infrastructure comprises impairing communication with the hostile program.

14. The apparatus of claim 13, wherein the disrupting, by the computer, further comprises disrupting a query for the DNS service related to a domain name within the hostile command and control infrastructure.

15. The apparatus of claim 13, wherein the processor is further configured to produce at least one of a snapshot of a memory of a computer or a hash value for each process in operation within the computer.

16. A non-transitory computer-readable storage medium storing instructions executable by a processor, wherein the instructions, when executed, perform a method comprising:

transmitting suspect command and control data to a control center, wherein

the suspect command and control data includes a reference to a domain name server (DNS) service, and

the control center is configured to

analyze the suspect command and control data, and

update a command and control infrastructure library, if the suspect command and control data is identified as hostile;

detecting a hostile program stored on the non-transitory computer-readable storage medium, wherein

the hostile program is identified by detecting that the reference to the DNS service in the suspect command and control data matches information in the command and control infrastructure library,

the detecting the reference to the DNS service in the suspect command and control data is performed prior to the suspect command and control data being submitted to a DNS server,

the hostile program is configured to be controlled by a hostile command and control infrastructure, and

the hostile command and control infrastructure is associated with a hostile computer;

disrupting the hostile command and control infrastructure, wherein

the disrupting comprises impairing communication with the hostile program.

17. The non-transitory computer-readable storage medium of claim 16, wherein the control center generates an activity-based signature for the hostile command and control infrastructure of the hostile program and integrates the activity-based signature into a security policy.

18. The non-transitory computer-readable storage medium of claim 16, further comprising:

monitoring a DNS query from the DNS server,

detecting that the DNS query is related to a domain within the hostile command and control infrastructure, and

preventing transmission of a response to the DNS query from the DNS server.

19. The non-transitory computer-readable storage medium of claim 16, further comprising:

monitoring a DNS query from a DNS client,

detecting that the DNS query is related to a domain within the command and control infrastructure library, and

preventing transmission of the DNS query to the DNS server.

20. The non-transitory computer-readable storage medium of claim 16, further comprising:

polling cached information for at least one DNS query related to a domain name within the hostile command and control infrastructure library.