Techniques for detecting malicious code
View Patent ↗Techniques for detecting malicious code are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting malicious code comprising the steps of identifying a query to a domain name service that resolves to a local address; identifying the process that originated the identified query; and designating the identified process as infected based on identifying the process as having originated the query that resolved to a local address.
1. A computer-implemented method for detecting malicious code comprising:
identifying a query to a domain name service that, when submitted to an internet DNS server, resolves to a local address;
identifying the process that originated the identified query; and
automatically designating, by at least one computer processor, the identified process as infected based on identifying the process as having originated the query that resolved to a local address.
2. The method of claim 1 , further comprising:
identifying a domain name used in the identified query; and
blocking a subsequent query based on a relationship between the subsequent query and the identified fully qualified domain name.
3. The method of claim 2 , wherein the identified domain name is a fully qualified domain name.
4. The method of claim 2 , wherein the subsequent query is blocked based on comparing a domain name used in the subsequent query to the identified domain name.
5. The method of claim 2 , further comprising:
identifying an IP address associated with the identified fully qualified domain name, wherein the subsequent query uses the identified IP address.
6. The method of claim 1 , wherein designating the identified process as infected is further based on one or more additional queries prior to the identified query that each resolved to a local address.
7. At least one non-transitory processor readable storage medium storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1 .
8. An article of manufacture for detecting malicious code, the article of manufacture comprising:
at least one non-transitory processor readable storage medium; and
instructions stored on the at least one medium;
wherein the instructions are configured to be readable from the at least one medium by at least one processor and thereby cause the at least one processor to operate so as to:
identify a query to a domain name service that, when submitted to an internet DNS server, resolves to a local address;
identify the process that originated the identified query; and
designate the identified process as infected based on identifying the process as having originated the query that resolved to a local address.
9. The article of manufacture of claim 8 , wherein the instructions are further configured to cause the at least one processor to operate so as to:
identify a domain name used in the identified query; and
block a subsequent query based on a relationship between the subsequent query and the identified fully qualified domain name.
10. The article of manufacture of claim 9 , wherein the identified domain name is a fully qualified domain name.
11. The article of manufacture of claim 9 , wherein the subsequent query is blocked based on comparing a domain name used in the subsequent query to the identified domain name.
12. The article of manufacture of claim 9 , wherein the instructions are further configured to cause the at least one processor to operate so as to identify an IP address associated with the identified fully qualified domain name, and wherein the subsequent query uses the identified IP address.
13. The article of manufacture of claim 8 , wherein designating the identified process as infected is further based on one or more additional queries prior to the identified query that each resolved to a local address.
14. A system for detecting malicious code comprising:
one or more processors communicatively coupled to a network; wherein the one or more processors are configured to:
identify a query to a domain name service that, when submitted to an internet DNS server, resolves to a local address;
identify the process that originated the identified query; and
designate the identified process as infected based on identifying the process as having originated the query that resolved to a local address; and
at least one memory, coupled to the one or more processors, configured to provide the one or more processors with instructions.
15. The system of claim 14 , wherein the one or more processors are further configured to:
identify a domain name used in the identified query; and
block a subsequent query based on a relationship between the subsequent query and the identified fully qualified domain name.
16. The system of claim 14 , wherein the identified domain name is a fully qualified domain name.
17. The system of claim 14 , wherein the subsequent query is blocked based on comparing a domain name used in the subsequent query to the identified domain name.
18. The system of claim 14 , wherein the one or more processors are further configured to identify an IP address associated with the identified fully qualified domain name, and wherein the subsequent query uses the identified IP address.
19. The system of claim 14 , wherein designating the identified process as infected is further based on one or more additional queries prior to the identified query that each resolved to a local address.