Methods and systems for providing security from malicious software

• US 20070011744A1
• Filed: 07/11/2005
• Published: 01/11/2007
• Est. Priority Date: 07/11/2005
• Status: Abandoned Application

• Current Assignee: Cox Communications Incorporated (Cox Enterprises Incorporated)
• Original Assignee: Cox Communications Incorporated (Cox Enterprises Incorporated)
• Inventors: Carothers, Matthew, Cerrato, Michael
• Application Number:
  US11/178,812
• Publication Number:
  US 20070011744A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Systems and methods are disclosed for providing security from malicious software. The disclosed systems and methods may include maintaining a malicious host database, the malicious host database containing a malicious host name corresponding to a malicious host. Furthermore, the disclosed systems and methods may include receiving, from a client, a service request including a first host name and querying the malicious host database to determine if the first host name corresponds to the malicious host name. Moreover, the disclosed systems and methods may include returning, to the client, a first address if it was determined that the first host name corresponds to the malicious host name.

Claims

1. A method for providing security from malicious software, the method comprising:

maintaining a malicious host database, the malicious host database containing a malicious host name corresponding to a malicious host;

receiving, from a client, a service request including a first host name;

querying the malicious host database to determine if the first host name corresponds to the malicious host name; and

returning, to the client, a first address if it was determined that the first host name corresponds to the malicious host name.

2. The method of claim 1, wherein returning, to the client, the first address if it was determined that the first host name corresponds to the malicious host name further comprises returning, to the client, the first address not corresponding to the malicious host.

3. The method of claim 1, further comprising receiving, at a server corresponding to the first address, communications from a malicious software module executing on the client.

4. The method of claim 3, wherein receiving, at the server corresponding to the first address, communications further comprises receiving at the server corresponding to the first address, communications including personal information.

5. The method of claim 1, further comprising receiving, at a server corresponding to the first address, communications from a malicious software module characterized as a trojan horse.

6. The method of claim 1, further comprising initiating, at the server corresponding to the first address, termination of the malicious software module executing on the client.

7. The method of claim 1, further comprising sending the service request to an authoritative server if the first host name does not correspond to the malicious host name.

8. A system for providing security from malicious software, the system comprising:

a memory storage for maintaining a database; and

a processing unit coupled to the memory storage, wherein the processing unit is operative to

maintain a malicious host database, the malicious host database containing a malicious host name corresponding to a malicious host;

receive, from a client, a service request including a first host name;

query the malicious host database to determine if the first host name corresponds to the malicious host name; and

return, to the client, a first address if it was determined that the first host name corresponds to the malicious host name.

9. The system of claim 8, wherein the processing unit being operative to return, to the client, the first address if it was determined that the first host name corresponds to the malicious host name further comprises the processing unit being operative to return, to the client, the first address not corresponding to the malicious host.

10. The system of claim 8, further comprising the processing unit being operative to receive, at a server corresponding to the first address, communications from a malicious software module executing on the client.

11. The system of claim 10, wherein the processing unit being operative to receive, at the server corresponding to the first address, communications further comprises the processing unit being operative to receive at the server corresponding to the first address, communications including personal information.

12. The system of claim 8, further comprising the processing unit being operative to receive, at a server corresponding to the first address, communications from a malicious software module characterized as a trojan horse.

13. The system of claim 8, further comprising the processing unit being operative to initiate, at the server corresponding to the first address, termination of the malicious software module executing on the client.

14. The system of claim 8, further comprising the processing unit being operative to send the service request to an authoritative server if the first host name does not correspond to the malicious host name.

15. A computer-readable medium which stores a set of instructions which when executed performs a method for providing security from malicious software, the method executed by the set of instructions comprising:

maintaining a malicious host database, the malicious host database containing a malicious host name corresponding to a malicious host;

receiving, from a client, a service request including a first host name;

querying the malicious host database to determine if the first host name corresponds to the malicious host name; and

returning, to the client, a first address if it was determined that the first host name corresponds to the malicious host name.

16. The computer-readable medium of claim 15, wherein returning, to the client, the first address if it was determined that the first host name corresponds to the malicious host name further comprises returning, to the client, the first address not corresponding to the malicious host.

17. The computer-readable medium of claim 15, further comprising receiving, at a server corresponding to the first address, communications from a malicious software module executing on the client.

18. The computer-readable medium of claim 17, wherein receiving, at the server corresponding to the first address, communications further comprises receiving at the server corresponding to the first address, communications including personal information.

19. The computer-readable medium of claim 15, further comprising initiating, at the server corresponding to the first address, termination of the malicious software module executing on the client.

20. The computer-readable medium of claim 15, further comprising sending the service request to an authoritative server if the first host name does not correspond to the malicious host name.