Website security

• US 9,825,973 B2
• Filed: 09/23/2015
• Issued: 11/21/2017
• Est. Priority Date: 10/07/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Sheleheda, Daniel, Amoroso, Edward G., Cama, Cynthia, Feng, Junlan, Leibolt, Gregory, Macwan, Sanjay, O'Hern, William, Torres, Valerie, Yu, Yuhong
• Primary Examiner(s): Lanier, Benjamin
• Application Number:
  US14/862,281
• Publication Number:
  US 20160014145A1
• Time in Patent Office: 790 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 65/4025 where none of the additional parallel sessions is real time or time sensitive, e.g. downloading a file in a parallel FTP session, initiating an email or combinational services

Abstract

Websites are monitored for changes over time. A domain name server resolves a domain name to a single internet protocol address and then performs a reverse resolution for the single internet protocol address. When multiple alias records resolve to the same host name, the domain name server determines the single internet protocol address virtually hosts multiple domain names.

Claims

1. A method, comprising:

identifying, by a domain name server, a port open to a communications network;

identifying, by the domain name server, a single internet protocol address associated with another server that is accessible via the port open to the communications network;

performing, by the domain name server, a domain name resolution that resolves the single internet protocol address to a hostname;

requerying, by the domain name server, the domain name resolution for the hostname;

retrieving, by the domain name server, multiple alias records having the domain name resolution with the hostname;

determining, by the domain name server, the single internet protocol address associated with the another server that is accessible via the open port virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the hostname;

downloading, by the domain name server at a first time, web pages associated with the multiple domain names;

generating, by the domain name server, first thumbnail images of the web pages downloaded at the first time;

downloading, by the domain name server at a later second time, the web pages associated with the multiple domain names;

generating, by the domain name server, second thumbnail images of the web pages downloaded at the later second time;

comparing, by the domain name server, the first thumbnail images to the second thumbnail images;

determining, by the domain name server, an image difference between corresponding ones of the first thumbnail images and the second thumbnail images; and

processing, by the domain name system, the image difference for display.

2. The method of claim 1, further comprising storing an entry in an electronic database that electronically associates filenames with the first thumbnail images.

3. The method of claim 1, further comprising determining a textual difference between any one of the first thumbnail images and a corresponding one of the second thumbnail images.

4. The method of claim 3, further comprising visually highlighting the textual difference.

5. A system comprising:

a processor; and

a memory device, the memory device storing code, the code when executed causing the processor to perform operations, the operations comprising;

identifying a port open to a communications network;

identifying a single internet protocol address associated with another server that is accessible via the port open to the communications network;

performing a domain name resolution that resolves the single internet protocol address to a hostname;

requerying the domain name resolution for the hostname;

retrieving multiple alias records having the domain name resolution with the hostname;

determining the single internet protocol address associated with the another server that is accessible via the open port virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the hostname;

downloading web pages associated with the multiple domain names;

generating first thumbnail images of the web pages;

redownloading the web pages associated with the multiple domain names at a later time;

generating second thumbnail images of the web pages downloaded at the later time;

comparing the first thumbnail images to the second thumbnail images;

determining an image difference between corresponding ones of the first thumbnail images and the second thumbnail images; and

processing the image difference for display.

6. The system of claim 5, wherein the operations further comprise storing an entry in an electronic database that electronically associates filenames with the first thumbnail images and times of the downloading of the web page.

7. The system of claim 5, wherein the operations further comprise determining a textual difference between one of the first thumbnail images and a corresponding one of the second thumbnail images.

8. The system of claim 7, wherein the operations further comprise visually highlighting the textual difference.

9. A memory device storing instructions that when executed causes a processor to perform operations, the operations comprising:

identifying, by a domain name server, a port open to a communications network;

identifying, by the domain name server, a single internet protocol address associated with a different server, the different server accessible via the port open to the communications network;

performing, by the domain name server, a domain name resolution that resolves the single internet protocol address to a hostname;

requerying, by the domain name server, the domain name resolution for the hostname;

retrieving, by the domain name server, multiple alias records having the domain name resolution with the hostname;

determining, by the domain name server, the single internet protocol address associated with the different server that is accessible via the port open virtually hosts multiple domain names in response to the multiple alias records having the domain name resolution with the hostname;

identifying, by the domain name server, web pages associated with each one of the multiple domain names virtually hosted by the another server;

downloading, by the domain name server, each one of the web pages associated with each one of the multiple domain names at a first time;

generating, by the domain name server, first thumbnail images of the each one of the web pages;

downloading, by the domain name server, the each one of the web pages associated with each one of the multiple domain names at a second time later than the first time;

generating, by the domain name server, second thumbnail images of the each one of the web pages at the second time;

comparing, by the domain name server, the first thumbnail images to the second thumbnail images;

determining, by the domain name server, an image difference between corresponding ones of the first thumbnail images and the second thumbnail images; and

processing, by the domain name system, the image difference for the display.

10. The memory device of claim 9, wherein the operations further comprise storing electronic associations in an electronic database between filenames associated with the first thumbnail images and the first time.

11. The memory device of claim 9, wherein the operations further comprise storing electronic associations in an electronic database between filenames associated with the second thumbnail images and the second time.

12. The memory device of claim 9, wherein the operations further comprise determining a textual difference between any one of the first thumbnail images and a corresponding one of the second thumbnail images.

13. The memory device of claim 12, wherein the operations further comprise visually highlighting the textual difference.

14. The memory device of claim 9, wherein the operations further comprise identifying all internet protocol addresses that are accessible via the port open to the communications network.