Apparatus for filtering server responses

• US 8,087,082 B2
• Filed: 12/03/2010
• Issued: 12/27/2011
• Est. Priority Date: 04/29/2006
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Bloch, Eric, Mohan, Shalabh, Pagaku, Rajendraprasad R., Moore, Doug, Krentel, Mark, Thompson, Bruce, Elischer, Julian R., Golm, Brandon L.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US12/959,542
• Publication Number:
  US 20110078309A1
• Time in Patent Office: 389 Days
• Field of Search: 726/1, 726/11, 726 13- 14, 726 22- 26, 713150-155, 713187-188, 709223-225, 709/229
• US Class Current: 726/22
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A data processing apparatus, comprising at least one processor and a traffic monitor comprising logic which, when executed by the processor, causes the processor to perform: creating, using forward Domain Name System (DNS) lookups, a mapping of domain names to Internet Protocol (IP) addresses; determining whether a particular domain in the mapping requires handling data traffic to or from the particular domain by performing a particular action; based on the mapping, determining one or more IP addresses that are associated with the particular domain; generating policy for a firewall that instructs the firewall to perform the particular action upon receiving a particular request; wherein the particular request specifies a particular IP address that is within the particular domain.

Claims

1. A data processing apparatus, comprising:

at least one processor;

a traffic monitor comprising logic which, when executed by the at least one processor, causes the at least one processor to perform;

creating, using forward Domain Name System (DNS) lookups, a mapping of domain names to Internet Protocol (IP) addresses;

wherein the mapping identifies only those domain names that are associated with malware;

determining whether a particular domain in the mapping requires handling data traffic to or from the particular domain by performing a particular action;

based on the mapping, determining one or more IP addresses that are associated with the particular domain;

generating policy for a firewall that instructs the firewall to perform the particular action upon receiving a request that specifies one or more IP addresses that are associated with the particular domain;

upon receiving a particular request comprising a particular IP address, using the policy and the mapping to determine whether the particular IP address is one of the one or more IP addresses associated with the particular domain to indicate that the particular action should be performed.

2. The apparatus of claim 1, wherein the traffic monitor further comprises logic which, when executed by the processor, causes the processor to perform:

using a DNS discovery process and a DNS traffic monitoring process to create the mapping;

observing the forward DNS lookups from an internal network and inspecting DNS transactions that take place in the internal network.

3. The apparatus of claim 1, wherein the traffic monitor further comprises logic which, when executed by the processor, causes the processor to perform sending instructions to the firewall for determining whether the particular request is to access any of the one or more IP addresses that are associated with the particular domain.

4. The apparatus of claim 1, wherein the particular action includes any of:

precluding traffic to the particular domain, precluding traffic from the particular domain, diverting traffic to the particular domain, diverting traffic from the particular domain, maintaining a log of activities at the particular domain, logging traffic information related to the particular domain, blocking or reporting on DNS hosts that belong to the particular domain, blocking or reporting on host-port combinations, blocking or reporting on domain-port combinations;

wherein the mapping further comprises state information and other information specific to the domain names.

5. The apparatus of claim 1, wherein the traffic monitor further comprises logic which, when executed by the processor, causes the processor to perform:

retrieving, from a web reputation service, reputation scores for the particular domain and reputation scores for subdomains that belong to the particular domain;

querying whitelists and blacklists.

6. The apparatus of claim 1, wherein the policy is further defined for an individual user or for groups of individual users.

7. A non-transitory computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

creating, using forward Domain Name System (DNS) lookups, a mapping of domain names to Internet Protocol (IP) addresses;

wherein the mapping identifies only those domain names that are associated with malware;

determining whether a particular domain in the mapping requires handling data traffic to or from the particular domain by performing a particular action;

based on the mapping, determining one or more IP addresses that are associated with the particular domain;

generating policy for a firewall that instructs the firewall to perform the particular action upon receiving a request that specifies one or more IP addresses that are associated with the particular domain;

upon receiving a particular request comprising a particular IP address, using the policy and the mapping to determine whether the particular IP address is one of the one or more IP addresses associated with the particular domain to indicate that the particular action should be performed.

8. The non-transitory computer-readable storage medium of claim 7, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

using a DNS discovery process and a DNS traffic monitoring process to create the mapping;

observing the forward DNS lookups from an internal network and inspecting DNS transactions that take place in the internal network.

9. The non-transitory computer-readable storage medium of claim 7, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform sending instructions to the firewall for determining whether the particular request is to access any of the one or more IP addresses that are associated with the particular domain.

10. The non-transitory computer-readable storage medium of claim 7, wherein the particular action includes any of:

precluding traffic to the particular domain, precluding traffic from the particular domain, diverting traffic to the particular domain, diverting traffic from the particular domain, maintaining a log of activities at the particular domain, logging traffic information related to the particular domain, blocking or reporting on DNS hosts that belong to the particular domain, blocking or reporting on host-port combinations, blocking or reporting on domain-port combinations;

wherein the mapping further comprises state information and other information specific to the domain names.

11. The non-transitory computer-readable storage medium of claim 7, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform:

retrieving, from a web reputation service, reputation scores for the particular domain and reputation scores for subdomains that belong to the particular domain;

querying whitelists and blacklists.

12. The non-transitory computer-readable storage medium of claim 7, wherein the policy is further defined for an individual user or for groups of individual users.

13. A method, comprising:

creating, using forward Domain Name System (DNS) lookups, a mapping of domain names to Internet Protocol (IP) addresses;

wherein the mapping identifies only those domain names that are associated with malware;

determining whether a particular domain, listed on the mapping, requires handling data traffic to or from the particular domain by performing a particular action;

based on the mapping, determining one or more IP addresses that are associated with the particular domain;

generating policy for a firewall that instructs the firewall to perform the particular action upon receiving a request that specifies one or more IP addresses that are associated with the particular domain;

upon receiving a particular request comprising a particular IP address, using the policy and the mapping to determine whether the particular IP address is one of the one or more IP addresses associated with the particular domain to indicate that the particular action should be performed;

wherein the method is performed by one or more processors.

14. The method of claim 13, further comprising:

using a DNS discovery process and a DNS traffic monitoring process to create the mapping;

observing the forward DNS lookups from an internal network and inspecting DNS transactions that take place in the internal network.

15. The method of claim 13, further comprising sending instructions to the firewall for determining whether the particular request is to access any of the one or more IP addresses that are associated with the particular domain.

16. The method of claim 13, wherein the particular action includes any of:

precluding traffic to the particular domain, precluding traffic from the particular domain, diverting traffic to the particular domain, diverting traffic from the particular domain, maintaining a log of activities at the particular domain, logging traffic information related to the particular domain, blocking or reporting on DNS hosts that belong to the particular domain, blocking or reporting on host-port combinations, blocking or reporting on domain-port combinations;

wherein the mapping further comprises state information and other information specific to the domain names.

17. The method of claim 13, further comprising:

retrieving, from a web reputation service, reputation scores for the particular domain and reputation scores for subdomains that belong to the particular domain;

querying whitelists and blacklists.

18. The method of claim 13, wherein the policy is further defined for an individual user or for groups of individual users.