Distributed frequency data collection via DNS

Abstract

Domain Name Service (DNS) requests are used as the reporting vehicle for ensuring that security-related information can be transferred from a network. As one possibility, a central facility for a security provider may maintain a data collection capability that is based upon receiving the DNS requests containing the information being reported. In an email application, if a data block is embedded within or attached to an email message, an algorithm is applied to the data block to generate an indicator that is specifically related to the contents of the data block. As one possibility, the algorithm may generate a hash that provides a “digital fingerprint” having a reasonable likelihood that the hash is unique to the data block. By embedding the hash within a DNS request, the request becomes a report that the data block has been accessed.

1 . A method of monitoring data traffic comprising:
 detecting occurrence of a transfer of a block of data with respect to a network node;   generating an indicator that is specifically related to contents of said block of data; and   reporting said transfer, including utilizing said indicator in a Domain Name Service (DNS) request.   
   
   
       2 . The method of  claim 1  wherein generating said indicator includes applying a particular algorithm to said block of data to define said indicator as a digital fingerprint that is a function of said algorithm. 
   
   
       3 . The method of  claim 2  wherein generating said indicator includes outputting a hash as a consequence of applying said algorithm, said reporting including forming said DNS request to include said hash. 
   
   
       4 . The method of  claim 1  wherein said reporting includes transmitting said DNS request to a remote site via a global communications network, thereby enabling said remote site to determine a count of occurrences of transfers of said block of data. 
   
   
       5 . The method of  claim 4  further comprising receiving instructions from said remote site as a response to said DNS request, said instructions being relevant to processing of said data traffic being monitored. 
   
   
       6 . The method of  claim 4  wherein said remote site is maintained by a central security provider enabled to select and implement corrective action on a basis of said count of occurrences of transfers. 
   
   
       7 . The method of  claim 6  wherein generating said indication is executed at one of a plurality of independent networks that are enabled to exchange data with said central security provider, said networks using a same algorithm to generate hashes upon said occurrences of transfers of blocks of data. 
   
   
       8 . The method of  claim 7  further comprising enabling said central security provider to receive DNS requests from each said network, wherein at least some of said DNS requests include said hashes. 
   
   
       9 . The method of  claim 1  further comprising combining a plurality of different said indications to form an aggregated said DNS request. 
   
   
       10 . The method of  claim 1  wherein detecting said transfer is specific to monitoring email transmissions. 
   
   
       11 . The method of  claim 10  wherein said block of data is an attachment of an email message. 
   
   
       12 . The method of  claim 10  wherein said block of data is an image which is a component of an email message. 
   
   
       13 . The method of  claim 10  wherein said indicator is generated to identify Uniform Resource Locators (URLs) detected within said email transmissions. 
   
   
       14 . The method of  claim 10  wherein said indicator is generated to identify IP addresses relevant to said email transmissions. 
   
   
       15 . The method of  claim 1  wherein said indicator is generated to identify an IP address of a source of said block of data. 
   
   
       16 . A method of providing security for a plurality of networks comprising:
 receiving Domain Name Service (DNS) requests originating from said networks, including DNS requests that include hashes determined at said networks by applications of an algorithm to transferred data blocks;   determining frequencies of transfers of different data blocks based on receiving said DNS requests that include different said hashes; and   forwarding security updates to said networks at least partially on a basis of determinations of said frequencies.   
   
   
       17 . The method of  claim 16  wherein forwarding said security updates relates to updating email security rules for application by spam filters of said networks. 
   
   
       18 . The method of  claim 17  wherein said hashes are formed upon applying said algorithm to components of emails exchanged via the Internet, said components including attachments and embedded images. 
   
   
       19 . The method of  claim 16  wherein receiving said DNS requests includes identifications of domain names containing said hashes. 
   
   
       20 . The method of  claim 16  wherein at least some of said DNS requests include indications of counts of transfers of said data blocks at individual said networks. 
   
   
       21 . The method of  claim 16  wherein each said DNS request includes a digital signature verifying the source of said DNS request, thereby enabling authentification of authorization to affect determinations of said frequencies. 
   
   
       22 . A network comprising:
 a plurality of user devices;   a network email server configured to enable email exchanges to and from said user devices;   a network email security device configured to filter said email exchanges, said network email security device including an algorithm component specific to generating digital signatures for components of email messages, said network email security device having a reporting component specific to forming and transmitting domain names that include said digital signatures; and   a network firewall connected along a path from the Internet and each of said user devices and said network email security devices.   
   
   
       23 . The network of  claim 22  wherein said reporting component is configured to transmit said domain names as DNS requests. 
   
   
       24 . The network of  claim 22  wherein said algorithm component is configured to generate a hash for data blocks that are transferred in said email exchanges, said data blocks including images and file attachments. 
   
   
       25 . The network of  claim 22  wherein said reporting component is configured to transmit said domain names to a central security provider, said network email security device being responsive to security updates received from said central security provider. 
   
   
       26 . A method of collecting data from a plurality of nodes comprising:
 at each of said nodes, determining information that is to be reported in order to enable data collection;   utilizing DNS requests as reporting vehicles for transmitting said information via the Internet, including embedding said information within said DNS requests in a format consistent with a protocol for transmissions via said Internet and further including forwarding said DNS requests for purposes of enabling said data collection; and   collecting said information as a consequence of said DNS requests.   
   
   
       27 . The method of  claim 26  wherein formatting said DNS requests includes incorporating a unique feature into said DNS requests from a particular one of said nodes, such that said DNS requests are not satisfied by operation of a local DNS server. 
   
   
       28 . The method of  claim 27  wherein said formatting utilizes time stamping to provide said unique feature. 
   
   
       29 . The method of  claim 27  wherein said formatting utilizes incorporating an incremented count for duplicate said DNS requests from said particular node.