Real time management of botnet attacks

1. A computer network monitoring system for monitoring a protected computer network for managing botnet attacks from within the protected computer network, the computer network monitoring system comprising a name server, the name server comprising:

a memory configured to store instructions;

a processor disposed in communication with the memory, wherein the processor, upon execution of the instructions is configured to:

receive a DNS request included in network traffic internal to the protected computer network from a source host included in the protected computer network, each DNS request included in the network traffic including a domain name of a target host and identifying a source address of the source host, wherein translation of the domain name provides an IP address of the source host;

compare the domain name of the DNS request to a botnet domain repository, the botnet domain repository including one or more entries, each entry having a confirmation indicator set to confirmed to indicate that the entry is confirmed or set to tentative to indicate that the entry is tentative;

if determined by the comparison that the domain name of the DNS request is included in the botnet domain repository, then:

store or update the source address of the DNS request in an infected host repository, wherein each source address stored in the infected host repository identifies a host known to be infected; and

output a control signal to a network controller to cause the network controller to cause any future network traffic to or from the source address to be diverted to an administrator configured address;

if determined by the comparison that the domain name is not included in the botnet domain repository, then determine by a second comparison whether the source address of the DNS request is included in the infected host repository; and

if determined by the second comparison that the source address of the DNS request is included in the infected host repository, then store the domain of the DNS request in the botnet domain repository having an associated confirmation indicator set to indicate that the source address is tentative, after which the DNS request is allowed to be handled for further processing as intended by the DNS request.

2. The computer network monitoring system of claim 1 , wherein if determined by the comparison that the domain name of the DNS request is included in the botnet domain repository, then the processor, upon execution of the instructions is further configured to send a DNS response to the DNS request indicating an administrator configured address which will cause the source host to send future network traffic to the administrator configured address by using the administrator configured address as the destination address of the future network traffic.

3. The computer network monitoring system of claim 1 , wherein the processor, upon execution of the instructions is further configured to, if determined by the second comparison that the source address is not included in the infected host repository, then allow the DNS request to be handled for the further processing as intended by the DNS request.

4. The computer network monitoring system of claim 3 , wherein allowing the DNS request to be handled for further processing includes forwarding the first DNS request to a recursive resolver.

5. The computer network monitoring system of claim 2 , further comprising a threat manager, the threat manager comprising:

a second memory configured to store instructions;

a second processor disposed in communication with the second memory, wherein the second processor, upon execution of the instructions is configured to:

when a portion of the future network traffic is received at the administrator configured address due to the destination address of the portion of the future network traffic being the administrator configured address:

cause generation of a fingerprint of the portion of the future network traffic; and

cause the fingerprint to be recorded in a fingerprint repository and the portion of the future network traffic to be dropped.

6. The computer network monitoring system of claim 5 , wherein when a portion of the network traffic or the future network traffic is received at the administrator configured address due to a diversion to the administrator configured address, the second processor upon execution of the instructions is further configured to cause to be processed any tentative entry in the botnet domain repository that corresponds to the portion of the network traffic or the future network traffic diverted to the administrator as a function of a fingerprint of the portion of the network traffic or future network traffic.

7. The computer network monitoring system of claim 6 , wherein when the fingerprint of the portion of the network traffic or the future network traffic diverted to the administrator configured address matches a fingerprint of network traffic that is recorded in the fingerprint repository, causing processing of the corresponding tentative entry in the botnet domain repository includes causing the confirmation indicator of the corresponding tentative entry to be changed from tentative to confirmed.

8. The computer network monitoring system of claim 7 , wherein the second processor is further configured to cause the portion of the network traffic or the future network traffic diverted to the administrator configured address to be dropped.

9. The computer network monitoring system of claim 6 , wherein when the fingerprint of the portion of the network traffic or the future network traffic diverted to the administrator configured address does not match fingerprints of network traffic that are recorded in the fingerprint repository a predetermined amount of times, causing the tentative entry in the botnet domain repository to be processed includes causing removal of the corresponding tentative entry from the botnet domain repository, and causing the portion of the network traffic or the future network traffic diverted to the administrator configured address to be handled for further processing as intended by the respective request or future request.

10. The computer network monitoring system of claim 1 , wherein the infected host repository is updated periodically to remove each source address that is stale due to nonuse of the source address or due to the source address not having been stored or updated within a selectable time interval.

11. A method of monitoring a protected computer network for managing botnet attacks from within the protected computer network, the method comprising:

receiving a DNS request included in network traffic internal to the protected computer network from a source host included in the protected computer network, each DNS request included in the network traffic including a domain name of a target host and identifying a source address of the source host, wherein translation of the domain name provides an IP address of the source host;

comparing the domain name of the DNS request to a botnet domain repository, the botnet domain repository including one or more entries, each entry having a confirmation indicator set to confirmed to indicate that the entry is confirmed or set to tentative to indicate that the entry is tentative;

if determined by the comparison that the domain name of the DNS request is included in the botnet domain repository, then:

storing or update the source address of the DNS request in an infected host repository, wherein each source address stored in the infected host repository identifies a host known to be infected; and

outputting a control signal to a network controller to cause the network controller to cause any future network traffic to or from the source address to be diverted to an administrator configured address;

if determined by the comparison that the domain name is not included in the botnet domain repository, then determining by a second comparison whether the source address of the DNS request is included in the infected host repository; and

if determined by the second comparison that the source address of the DNS request is included in the infected host repository, then storing the domain of the DNS request in the botnet domain repository having an associated confirmation indicator set to indicate that the source address is tentative, after which the DNS request is allowed to be handled for further processing as intended by the first DNS request.

12. The method of claim 11 , further comprising, wherein if determined by the comparison that the domain name of the DNS request is included in the botnet domain repository, sending a DNS response to the DNS request indicating an administrator configured address which will cause the host associated with the source address to send future network traffic to the administrator configured address by using the administrator configured address as the destination address of the future network traffic.

13. The method of claim 11 , further comprising if determined by the second comparison that the source address is not included in the infected host repository, then allowing the DNS request to be handled for the further processing as intended by the DNS request.

14. The method of claim 13 , wherein allowing the DNS request to be handled for further processing includes forwarding the first DNS request for recursive resolving of the DNS request's domain name into its destination address.

15. The method of claim 12 , further comprising when a portion of the future network traffic is received at the administrator configured address due to the destination address of the portion of the future network traffic being the administrator configured address:

causing generation of a fingerprint of the portion of the future network traffic; and

causing the fingerprint to be recorded in a fingerprint repository and the portion of the future network traffic to be dropped.

16. The method of claim 15 , further comprising when a portion of the network traffic or the future network traffic is received at the administrator configured address due to a diversion to the administrator configured address, causing to be processed as a function of a fingerprint of the network traffic or future network traffic any tentative entry in the botnet domain repository that corresponds to the portion of the network traffic or the future network traffic diverted to the administrator.

17. The method of claim 16 , further comprising, when the fingerprint of the portion of the network traffic or the future network traffic diverted to the administrator configured address matches a fingerprint of network traffic that is recorded in the fingerprint repository, causing processing of the corresponding tentative entry in the botnet domain repository includes causing the confirmation indicator of the corresponding tentative entry to be changed from tentative to confirmed.

18. The method of claim 17 , further comprising causing to be dropped the portion of the network traffic or the future network traffic diverted to the administrator configured address.

19. The method of claim 16 , further comprising, when the fingerprint of the portion of the network traffic or the future network traffic diverted to the administrator configured address does not match fingerprints of network traffic that are recorded in the fingerprint repository a predetermined amount of times, causing the tentative entry in the botnet domain repository to be processed includes causing removal of the corresponding tentative entry from the botnet domain repository, and causing the portion of the network traffic or the future network traffic diverted to the administrator configured address to be handled for further processing as intended by the respective network traffic or future network traffic.

20. The method of claim 11 , further comprising periodically updating the infected host repository to remove each source address that is stale due to nonuse of the source address or due to the source address not having been stored or updated within a selectable time interval.