Automated service for blocking malware hosts
View Patent ↗Systems, methods, and/or techniques (“tools”) that relate to an automated service for blocking malware hosts are described herein. In different implementations, the tools receive network addresses identifying hosts that are discovered to contain malware. The tools also provide the network addresses to a collection and storage service. Other components provided by the tools receive the network addresses from, for example, a plurality of reporting clients. These components may aggregate the network addresses across the reporting clients, and store instances of the malware and associated malware addresses.
1. A computer-readable storage device comprising a program of instructions stored on the computer-readable storage device that, when executed by a computer, cause the computer to perform operations comprising:
transmitting a download request by the computer via a network to a network host for content that contains malware;
receiving, by the computer via the network in response to the transmitting, the content that contains malware from the network host or one or more other hosts;
detecting, by the computer, the malware in the content;
associating, by the computer, at least one indication of at least one network address from which the malware was downloaded to include a network address of the network host, and when the network host redirects the download request to the one or more other hosts, the computer receives the content that contains the malware from the one or more other hosts and the at least one network address includes a network address of each of the one or more other hosts; and
providing the at least one indication of the at least one network address to a collection and storage service.
2. The computer-readable storage device of claim 1 , further comprising instructions for causing the computer to associate at least one instance of malware with the at least one network address.
3. The computer-readable storage device of claim 1 , further comprising instructions for causing the computer to associate an instance of malware with at least a further network address.
4. The computer-readable storage device of claim 1 , further comprising instructions for causing the computer to notify at least one user that the at least one network address hosts malware.
5. The computer-readable storage device of claim 1 , further comprising instructions for causing the computer to notify at least one user that the at least one network address has been blocked.
6. The computer-readable storage device of claim 1 , wherein the instructions for causing the computer to receive the at least one indication of the at least one network address include instructions for receiving the at least one indication from an anti-malware component, the at least one indication being based on correlation of a malware signature associated with the anti-malware component.
7. A computer-readable storage device comprising a program of instructions stored on the computer-readable storage medium that, when executed by the computer, cause the computer to perform operations comprising:
receiving indications of malware instances associated with at least one network address from a reporting clients, wherein the malware instances are identified by the reporting clients by evaluating content requested by the reporting clients that is downloaded from at least one network host corresponding to the at least one network address;
validating the indications of the malware instances based at least in part on correlation of a malware signature associated with each of the malware instances, each malware signature identifying and characterizing an associated one of the malware instances;
storing the validated indications of the malware instances and the at least one network address;
formulating malware notifications based at least in part on the malware instances and the at least one network address;
searching, based on the validating, subscription records for identifying one or more receiving clients that have subscribed to a malware reporting and notification service; and
transmitting the malware notifications to the one or more receiving clients identified to block communications between the one or more receiving clients and the at least one network address.
8. The computer-readable storage device of claim 7 , wherein the instructions for causing the computer to store the malware instances and the at least one network address include instructions for causing the computer to store the malware instances and the at least one network address into a blocklist database.
9. The computer-readable storage device of claim 7 , further comprising instructions for causing the computer to receive confirmed malware reports from a blocklist database for the formulating of the malware notifications.
10. The computer-readable storage device of claim 7 , wherein the malware notifications include the at least one network address.
11. The computer-readable storage device of claim 7 , further comprising instructions for notifying a user of at least one of the one or more receiving clients that further access to the at least one network address has been blocked.
12. The computer-readable storage device of claim 7 , further comprising instructions for causing the computer to block further access to the at least one network address.
13. The computer-readable storage device of claim 7 , further comprising instructions for causing the computer to establish a retest period for a malware address and evaluate whether the retest period has expired.
14. The computer-readable storage device of claim 13 , wherein the instructions for causing the computer to establish the retest period include instructions for causing the computer to consider a number of times that the malware address has hosted malware.
15. The computer-readable storage device of claim 13 , wherein the instructions for causing the computer to establish the retest period include instructions for causing the computer to consider a number of requests to the malware address.
16. The computer-readable storage device of claim 7 , further comprising instructions for causing the computer to retest the at least one network address.
17. The computer-readable storage device of claim 7 , further comprising instructions for causing the computer to unblock the at least one network address.
18. A method implemented by at least one computer, the method comprising:
receiving indications of malware instances associated with at least one network address from reporting clients, wherein the malware instances are identified by the reporting clients by evaluating content requested by the reporting clients that is downloaded from at least one network host corresponding to the at least one network address;
validating received indications to find validated indications of the malware instances associated with the at least one network address, the validating comprising determining that the at least one network address hosts a malware instance, the determining based in part on correlation of a malware signature associated with an anti-malware component;
aggregating the validated indications and the at least one network address;
storing the validated indications and the at least one network address;
searching, responsive to the storing, subscription records to identify one or more receiving clients;
formulating, by the at least one computer, malware notifications based at least in part on the validated indications and the at least one network address; and
transmitting the malware notifications to the one or more receiving clients identified to block communications between the one or more receiving clients and the at least one network address.