System, method and computer program product for gathering information relating to electronic content utilizing a DNS server

• US 9,246,860 B2
• Filed: 10/09/2013
• Issued: 01/26/2016
• Est. Priority Date: 02/09/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sargent, John
• Primary Examiner(s): Pollack, Melvin H
• Application Number:
  US14/049,858
• Publication Number:
  US 20140040403A1
• Time in Patent Office: 839 Days
• Field of Search: 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system, method and computer program product are provided. In use, a checksum associated with electronic content is calculated. Further, a domain name service (DNS) server is queried utilizing the checksum. In response to the query, information is received from the DNS server which relates to the electronic content.

Claims

1. A method, comprising:

calculating a checksum associated with electronic content that refers to an electronic e-mail message;

sending the checksum to a domain name service (DNS) server;

receiving information from the DNS server, the information comprising an Internet Protocol (IP) address associated with the checksum; and

taking an action on the e-mail message based on the IP address.

2. The method of claim 1, further comprising:

caching the checksum and the IP address for a predetermined amount of time.

3. The method of claim 1, wherein a plurality of domains is provided for servicing different types of checksums such that a particular DNS server that receives a particular checksum is selected based on the particular checksum.

4. The method of claim 1, further comprising:

determining whether a particular checksum is present in a cache; and

querying the DNS server for a particular IP address associated with the particular checksum if the particular checksum is not in the cache.

5. The method of claim 1, wherein if a particular IP address is not identified by the DNS server for a particular electronic e-mail message, a default action is taken and the particular electronic e-mail message is presumed to be wanted.

6. The method of claim 1, wherein the checksum includes a value or a signature derived from a calculation performed on one or more components of the electronic content in the electronic e-mail message.

7. The method of claim 6, wherein the one or more components are selected from a group of components, the group consisting of:

a) an image;

b) a binary string;

c) a uniform resource locator (URL);

d) a text string;

e) a plurality of characters; and

f) a plurality of bits.

8. The method of claim 1, wherein each IP address delivered by the DNS server provides access to particular information associated with a particular electronic mail message property represented by a particular checksum.

9. The method of claim 1, wherein the action is selected from a group of actions, the group consisting of:

a) quarantining the electronic content;

b) deleting the electronic content;

c) cleaning the electronic content;

d) generating an alert; and

e) notifying an administrator regarding the electronic content.

10. The method of claim 1, wherein querying the DNS server is conditionally performed based on whether the IP address associated with the electronic e-mail message is cached.

11. One or more computer-readable storage media storing instructions that, when executed, cause a computing device to perform a method, the method comprising:

calculating a checksum associated with electronic content that refers to an electronic e-mail message;

sending the checksum to a domain name service (DNS) server;

receiving information from the DNS server, the information comprising an Internet Protocol (IP) address associated with the checksum; and

taking an action on the e-mail message based on the IP address.

12. The media method of claim 11, the method further comprising:

caching the checksum and the IP address for a predetermined amount of time.

13. The media of claim 11, wherein a plurality of domains is provided for servicing different types of checksums such that a particular DNS server that receives a particular checksum is selected based on the particular checksum.

14. The media of claim 11, the method further comprising:

determining whether a particular checksum is present in a cache; and

querying the DNS server for a particular IP address associated with the particular checksum if the particular checksum is not in the cache.

15. The media of claim 11, wherein if a particular IP address is not identified by the DNS server for a particular electronic e-mail message, a default action is taken and the particular electronic e-mail message is presumed to be wanted.

16. The media of claim 11, wherein the checksum includes a value or a signature derived from a calculation performed on one or more components of the electronic content in the electronic e-mail message.

17. The media of claim 16, wherein the one or more components are selected from a group of components, the group consisting of:

a) an image;

b) a binary string;

c) a uniform resource locator (URL);

d) a text string;

e) a plurality of characters; and

f) a plurality of bits.

18. The media of claim 11, wherein each IP address delivered by the DNS server provides access to particular information associated with a particular electronic mail message property represented by a particular checksum.

19. The media of claim 11, wherein the action is selected from a group of actions, the group consisting of:

f) quarantining the electronic content;

g) deleting the electronic content;

h) cleaning the electronic content;

i) generating an alert; and

j) notifying an administrator regarding the electronic content.

20. The media of claim 11, wherein querying the DNS server is conditionally performed based on whether the IP address associated with the electronic e-mail message is cached.

21. A computer, comprising:

a processor; and

a memory coupled to the processor, wherein the computer is configured to;

calculate a checksum associated with electronic content that refers to an electronic e-mail message;

send the checksum to a domain name service (DNS) server;

receive information from the DNS server, the information comprising an Internet Protocol (IP) address associated with the checksum; and

take an action on the e-mail message based on the IP address.

22. The computer of claim 21, wherein the computer is further configured to:

cache the checksum and the IP address for a predetermined amount of time.

23. The computer of claim 21, wherein a plurality of domains is provided for servicing different types of checksums such that a particular DNS server that receives a particular checksum is selected based on the particular checksum.

24. The computer of claim 21, wherein the computer is further configured to:

determine whether a particular checksum is present in a cache; and

query the DNS server for a particular IP address associated with the particular checksum if the particular checksum is not in the cache.

25. The computer of claim 21, wherein if a particular IP address is not identified by the DNS server for a particular electronic e-mail message, a default action is taken and the particular electronic e-mail message is presumed to be wanted.

26. The computer of claim 21, wherein the checksum includes a value or a signature derived from a calculation performed on one or more components of the electronic content in the electronic e-mail message.

27. The computer of claim 21, wherein each IP address delivered by the DNS server provides access to particular information associated with a particular electronic mail message property represented by a particular checksum.

28. The computer of claim 21, wherein the action is selected from a group of actions, the group consisting of:

a) quarantining the electronic content;

b) deleting the electronic content;

c) cleaning the electronic content;

d) generating an alert; and

e) notifying an administrator regarding the electronic content.

29. The computer of claim 21, wherein querying the DNS server is conditionally performed based on whether the IP address associated with the electronic e-mail message is cached.