System, method and computer program product for gathering information relating to electronic content utilizing a DNS server

• US 8,601,160 B1
• Filed: 02/09/2006
• Issued: 12/03/2013
• Est. Priority Date: 02/09/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sargent, John
• Primary Examiner(s): Pollack, Melvin H
• Application Number:
  US11/351,840
• Time in Patent Office: 2,854 Days
• Field of Search: 709/245, 709/203, 709217-219, 709/227, 709/237, 709/249, 709/206, 707697-699, 370/395.52
• US Class Current: 709/245
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system, method and computer program product are provided. In use, a checksum associated with electronic content is calculated. Further, a domain name service (DNS) server is queried utilizing the checksum. In response to the query, information is received from the DNS server which relates to the electronic content.

Claims

1. A method, comprising:

calculating a checksum associated with electronic content associated with an electronic e-mail message;

querying a selected one of a plurality of domain name service (DNS) servers, wherein at least one of the servers is associated with an antispam domain configured to evaluate checksum data and to maintain a cache that includes a plurality of checksum entries; and

receiving information from the selected DNS server relating to the electronic content, wherein the information includes an Internet Protocol (IP) address retrieved from the cache, and the information is utilized to look up additional information that identifies whether the electronic e-mail message is to be quarantined and that indicates a time for which the checksum is to be cached.

2. The method of claim 1, wherein the checksum is generated based on an image associated with the electronic content.

3. The method of claim 1, wherein the checksum is generated based on a binary string associated with the electronic content.

4. The method of claim 1, wherein the checksum is generated based on a uniform resource locator (URL) associated with the electronic content.

5. The method of claim 1, wherein the checksum is generated based on a text string associated with the electronic content.

6. The method of claim 1, wherein the IP address is utilized to determine whether the electronic content is unwanted.

7. The method of claim 1, wherein the IP address is utilized to determine an action to be taken on the electronic content.

8. The method of claim 1, wherein the plurality of DNS servers includes a remote DNS server, and the checksum and the IP address are cached utilizing a local DNS server.

9. The method of claim 1, wherein the querying is conditionally performed based on whether the IP address is cached.

12. The method of claim 1, wherein the information includes the IP address relating to the electronic content and the selected DNS server resolves a string concocted utilizing the checksum and formatted as a host name with the IP address.

13. The method of claim 1, wherein the query to the selected DNS server utilizing the checksum includes prepending the checksum to a domain name of the selected DNS server.

14. The method of claim 1, wherein the plurality of DNS servers includes a first DNS server that is used for checksums associated with images if the checksum is associated with an image in an electronic email message, and the plurality of DNS servers includes a second DNS server that is used for checksums associated with text strings if the checksum is associated with text strings in an electronic email message.

15. The method of claim 1, wherein the IP address is a dotted-quad IP address in the format ‘

aaa.b.c.d’

, and provides specific information about the electronic content.

16. The method of claim 15, wherein each of ‘

aaa’

, ‘

b’

, ‘

c’

, and ‘

d’

of the IP address are associated with at least one of an identification of a property of the electronic content, an identification of a type of the property of the electronic content, an identification of an action to be taken on the electronic content, and an identification of a duration of which at least one of the checksum and the IP address is to be cached.

10. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

calculating a checksum associated with electronic content associated with an electronic e-mail message;

querying a selected one of a plurality of domain name service (DNS) servers, wherein at least one of the servers is associated with an antispam domain configured to evaluate checksum data and to maintain a cache that includes a plurality of checksum entries; and

obtaining information relating to the electronic content based on the query, wherein the information includes an Internet Protocol (IP) address retrieved from the cache and is utilized to look up additional information that identifies whether the electronic e-mail message is to be quarantined and that indicates a time for which the checksum is to be cached.

11. A system, comprising:

a computer, wherein the system is configured for;

calculating a checksum associated with electronic content associated with an electronic e-mail message; and

querying a selected one of a plurality of domain name service (DNS) servers, wherein at least one of the servers is associated with an antispam domain configured to evaluate checksum data and to maintain a cache that includes a plurality of checksum entries, wherein information relating to the electronic content is made available utilizing the DNS server query, and wherein the information includes an Internet Protocol (IP) address retrieved from the cache, and the information is utilized to look up additional information that identifies whether the electronic e-mail message is to be quarantined and that indicates a time for which the checksum is to be cached.