Method and system for abuse route aggregation and distribution

• US 9,071,575 B2
• Filed: 04/20/2012
• Issued: 06/30/2015
• Est. Priority Date: 04/21/2011
• Status: Active Grant

• Current Assignee: Duleep G. Pillai, Robert K. Lemaster, Vikas Khanna
• Original Assignee: Robert K. Lemaster
• Inventors: Lemaster, Robert K., Pillai, Duleep G., Khanna, Vikas
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US13/452,820
• Publication Number:
  US 20120272331A1
• Time in Patent Office: 1,166 Days
• Field of Search: 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In one exemplary embodiment, a computer-implemented method includes receiving a request to block a host, wherein the host provides a prohibited content via a computer network. A spider program can verify that the host provides the prohibited content. An abuse route list can be generated. The abuse route list can include an internet protocol address of the host. The abuse route list is provided to a network operator with a computer networking protocol. A search engine of a database of infringing hosts can be provided. The database of infringing hosts can include the internet protocol address of the host. Whether the host provides the prohibited content can be reverified with a third-party review. The host from can be removed from the abuse route list if the third-party review determines that the host does not provide prohibited content.

Claims

1. A computer-implemented method comprising:

receiving, by at least one microprocessor, wherein the host provides a prohibited content via a computer network;

verifying that the host provide the prohibited content with a spider program;

generating an abuse route list, wherein the abuse route list comprises an internet protocol address of the host;

providing the abuse route list to a network operator with a computer networking protocol;

providing a search engine of a database of infringing hosts, wherein the database of infringing host comprises the internet protocol address of the host;

reverifying that the host provides the prohibited content with a third-party review, wherein the third party comprises a third-party that determines that the prohibited content comprises a copyright violation or trademark infringing material; and

removing the host from the abuse route list if the third-party review determines that the host does not provide prohibited content.

2. The computer-implemented method of claim 1, further comprising:

periodically reverifying that the host provides the prohibited content with the spider program.

3. The computer-implemented method of claim 2, further comprising:

removing the host from the abuse route list if the spider program determines that the host does not provide prohibited content.

4. The computer-implemented method of claim 1, further comprising:

generating a routing table, wherein the rowing table comprises an entry for the host, wherein the entry specifies that a data packet addressed to the host is sent to a null route.

5. The computer-implemented method of claim 1, wherein the computer network comprises the Internet.

6. The computer-implemented method of claim 1, further comprising:

generating a white list of hosts, wherein in v host listed in the white list is automatically removed from the abuse route list.

7. The computer-implemented method of claim 1, wherein the abuse route list comprises a set of Internet protocol addresses originating in a network-operator specified geographical region.

8. The computer-implemented method of claim 7, wherein the abuse route list comprises a set of Internet protocol addresses originating in a network-operator sped fled nation.

9. The computer-implemented method of claim 1, wherein the computer networking protocol comprises a Border Gateway Protocol.

10. The computer-implemented method of claim 1, wherein a partner entity performs the third-party review.

11. A non-transitory computer readable medium containing program instructions for dropping traffic destined to hosts that provide prohibited content, wherein execution of the program instructions by one or more processors of a computer system causes the one or more processors to carry out the steps of;

receiving a request to block a host, wherein the host provides a prohibited content via a computer network, and wherein the prohibited content comprises a copyright violation;

verifying that the host provides the prohibited content with a spider program;

generating an abuse route list, wherein the abuse route list comprises an internet protocol address of the host;

providing the abuse route list to a network operator with a computer networking protocol;

providing a search engine of a database of infringing hosts, wherein the database of infringing host comprises the internet protocol address of the host,

reverifying that the host provides the prohibited content with a third-party review, wherein the third party comprises a third-party that determines that the prohibited content comprises a copyright violation; and

removing the host from the abuse route list if the third-party review determines that the host does not provide prohibited content.

12. The computer readable medium of claim 11 wherein execution of the program instructions by one or more processors of a computer system causes the one or more processors to further carry out the step of:

generating a routing table, wherein the routing table comprises an entry for the host, wherein the entry specifies that a data packet addressed to the host is sent to a null mute.

13. The computer readable medium of claim 11, wherein the computer network comprises the Internet.

14. The computer readable medium of claim 11, wherein the computer networking protocol comprises a Border Gateway Protocol.

15. A method comprising:

determining, by at least one microprocessor, an infringing host, wherein the infringing host comprises a host that provides a prohibited content, wherein the prohibited content comprises a copyright violation;

providing an infringing host'"'"'s identification to a network operator;

algorithmically confirming that the infringing host provides the prohibited content;

enabling a search of the infringing host, wherein the infringing host'"'"'s identification comprises an internet protocol address of the infringing host, and wherein the database comprises the internet protocol address of the infringing host;

providing the internet protocol address of the infringing host to the network operator with a Border Gateway Protocol;

determining that the infringing host provides the prohibited content with a third-party review if an end user requests a review of a status of the infringing host; and

generating a list of internet protocol addresses comprising at least one of a list of bogon routes, a list of botnet command and control hosts, and a list of hosts provided by a governmental organization.