System and method to manage sinkholes

• US 9,497,213 B2
• Filed: 07/08/2013
• Issued: 11/15/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: FireEye, Inc.
• Inventors: Thompson, Matthew, Hijazi, Karim
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US13/936,706
• Publication Number:
  US 20140283063A1
• Time in Patent Office: 1,226 Days
• Field of Search: 726/23
• US Class Current: 1/1
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method operable to manage and/or distribute sinkholes.

Claims

1. A method to resolve domain names through a managed sinkhole distribution, the method comprising:

initiating a top level domain (TLD)zone update at a first authoritative name server, the zone update includes one or more top level domain zone file changes for a target domain that redirects a query for an Internet Protocol (IP) address for the target domain to one or more authoritative name servers associated with a sinkhole island instead of directing the query to a second authoritative name server for the target domain that is different from the one or more authoritative name servers; and

subsequent to the zone update, receiving the query for the IP address for the target domain by the one or more authoritative name servers associated with the sinkhole island that is one of a plurality of sinkhole islands associated with a sinkhole, each of the plurality of sinkhole islands being distributed and operating independently from another sinkhole island of the plurality of sinkhole islands and the query for the IP address for the target domain is in response to a request for the IP address from a source,

wherein the one or more authoritative name servers associated with the sinkhole island is configured to access a database for the IP address for the target domain and return an IP address for a sinkhole sensor node within the sinkhole island to the source that initiated the request for IP address.

2. The method of claim 1, wherein the zone update is conducted by a cooperative registrar of the target domain that has authority to make the one or more top level domain zone file changes for the target domain in response to receiving a takedown request upon occurrence of an event.

3. The method of claim 1, wherein prior to receiving the query for the IP address for the target domain, the method further comprises receiving the request for the IP address by a recursive server.

4. The method of claim 3, wherein the source is a stub resolver.

5. The method of claim 3, wherein the zone update redirects the query for the IP address by preventing reception by the recursive server of glue records directed to the second authoritative name server and, in response to request for the IP address, providing glue records instructing the recursive server to issue the query for the IP address to the one or more authoritative name servers.

6. The method of claim 1, wherein each of the plurality of sinkhole islands is physically distributed from a neighboring sinkhole island of the plurality of sinkhole islands and includes an authoritative name server.

7. The method of claim 6, wherein the query for the IP address for the target domain is directed to an authoritative name server of the one or more authoritative name servers that is associated with the sinkhole island.

8. The method of claim 6, wherein each of the plurality of sinkhole islands is associated with a unique domain name system (DNS) name.

9. The method of claim 6, wherein each of the plurality of sinkhole islands further includes one or more sinkhole sensor nodes including the sinkhole sensor node.

10. The method of claim 1, wherein the IP address for the sinkhole sensor node is returned to a malware via a stub resolver.

11. The method of claim 1, wherein prior to initiating the zone update at the first authoritative name server, the method further comprising:

distributing components of the sinkhole to formulate the plurality of sinkhole islands.

12. The method of claim 11, further comprising:

setting the sinkhole sensor node to one or more IP addresses.

13. The method of claim 1, wherein the event is one or more of (i) an identification of a new malware author or group, (ii) an identification of a new malware family, or (iii) an elapse of a predetermined period of time.

14. The method of claim 1, wherein the event is one or more of (i) an occurrence of a public event, (ii) an identification of a new malware author or group, (iii) an identification of a new malware family, (iv) a component reaching a threshold, or (v) an elapse of a predetermined period of time.

15. The method of claim 1, wherein one or more sinkhole islands of the plurality of sinkhole islands being automatically created in response to a predetermined period of time has elapsed.

16. The method of claim 1, wherein the plurality of sinkhole islands enable one or more domains to be isolated to a particular sinkhole island of the plurality of sinkhole islands to prevent discovery of a remainder of the plurality of sinkhole islands associated with the sinkhole.

17. The method of claim 1, wherein the sinkhole island includes the one or more authoritative name servers and the sinkhole sensor node that operate to substitute the target domain with the IP address operating as a substitute domain for the target domain.

18. The method of claim 17, wherein a second sinkhole island of the plurality of sinkhole islands includes at least one authoritative name server and a sinkhole sensor node and the second sinkhole island being associated with a domain different than the target domain.

19. A system to provide a managed sinkhole distribution scheme, comprising:

one or more authoritative name servers associated with a sinkhole island of a plurality of sinkhole islands, the one or more authoritative name servers to receive a query generated in response to a request for an Internet Protocol (IP) address for the target domain subsequent to a top level domain (TLD) zone update that redirects the query to the one or more authoritative name servers instead of a first authoritative name server for the target domain that is different from the one or more authoritative name servers, each of the plurality of sinkhole islands being distributed and operating independently from another sinkhole island of the plurality of sinkhole islands; and

a database accessible by the one or more authoritative name servers associated with the sinkhole island, the database being accessed for the IP address for the target domain and, upon locating the IP address for the target domain, returns an IP address for a sinkhole sensor node within the sinkhole island to the one or more authoritative name servers for routing to a source that initiated the request for the IP address,

wherein each of the one or more authoritative name servers includes a processor and a memory.

20. The system of claim 19, wherein the query is further generated in response to a change in a top level domain zone file for the target domain performed by a cooperative registrar.

21. The system of claim 19 further comprising a recursive server configured to receive the request for the IP address prior to initiating the query for the IP address for the target domain to the one or more authoritative name servers.

22. The system of claim 19, wherein each of the plurality of sinkhole islands is physically distributed from a neighboring sinkhole island of the plurality of sinkhole islands and includes an authoritative name server.

23. The system of claim 22, wherein each of the plurality of sinkhole islands is associated with a unique domain name system (DNS) name.

24. The system of claim 23, wherein each of the plurality of sinkhole islands includes one or more sinkhole sensor nodes.

25. The system of claim 19, wherein one or more specific domains are isolated to the sinkhole island of the plurality of sinkhole islands to prevent discovery of a remainder of the plurality of sinkhole islands associated with the sinkhole.

26. The system of claim 19, wherein the sinkhole island includes the one or more authoritative name servers and the sinkhole sensor node that operate to substitute the target domain with the IP address operating as a substitute domain for the target domain.

27. The system of claim 26 further comprising a second sinkhole island of the plurality of sinkhole islands communicatively coupled to the database and associated with a domain that is different from the target domain, the second sinkhole includes at least one authoritative name server and a sinkhole sensor node.