RU2776349C1 - Systems and methods for using dns messages for selective collection of computer forensic data - Google Patents

Abstract

FIELD: data processing.

SUBSTANCE: invention relates to the field of data processing. This effect is achieved by intercepting a Domain Name Service (DNS) response message received on a computer system, wherein the DNS response message contains a target Internet Protocol (IP) address indicating the network location of the remote resource, wherein the DNS response message further comprises an activation flag services, determining, according to the value of the service activation flag, whether the forensic data collection service is active, in response, if the service activation flag indicates that the forensic data collection service is active, modifying the DNS response message by replacing the target IP address with a dummy IP address, intercepting electronic communication directed to the destination IP address, determining whether the destination IP address matches the bogus IP address, in response to determining whether the destination IP address matches the bogus IP address if the destination IP address matches the bogus IP address IP address, a forensic data collection procedure is performed to characterize the emerging malicious code, wherein the forensic data collection procedure comprises transmitting a set of metadata characterizing electronic communication to a remote security server.

EFFECT: enabling the collection of computer security data from client devices.

20 cl, 13 dwg

Description

FIELD OF TECHNOLOGY TO WHICH THE INVENTION RELATES

[0001] The invention relates to systems and methods for combating malware and, in particular, to the selective collection of network traffic samples for forensic analysis.

[0002] Malicious software, also known as malicious code, infects a large number of computer systems around the world. In its many forms, such as computer viruses, Trojan horses, spyware, and ransomware, malware poses a serious risk to millions of computer users, making them vulnerable to, among other things, data and confidential information loss, identity theft, and loss of performance.

[0003] A large number of devices, informally referred to as the Internet of Things (IoT), are increasingly connected to communication networks and the Internet. Such devices include, but are not limited to, smartphones, smart watches, televisions and other multimedia devices, game consoles, home appliances, and various household sensors such as thermostats. As more of these devices go online, they become vulnerable to security threats such as malware and intrusion. Therefore, there is a growing need to protect such devices from malicious code, as well as to protect communication with and from such devices. A particular area that has received renewed interest with the advent of the Internet of Things includes access control applications, such as parental controls, and the prevention of sensitive information transmission through IoT devices.

[0004] Malicious software is constantly evolving, prompting computer security providers to keep up with the ever-changing threat landscape. Part of these efforts is aimed at the timely detection and analysis of emerging malicious code. One specific category of anti-malware methods, commonly known as behavioral detection, is based on monitoring device and/or software component activity according to a set of rules. Some activity patterns (eg, sequences of hardware or software events) correspond to normal legitimate uses of the device in question, while others may indicate malicious activity. Reliable identification of abnormal behavior patterns that indicate the presence of malicious code usually requires a sufficient amount of forensic data collected from infected devices. If data traffic is detected that indicates the presence of malicious code, the study of such patterns may require access to network traffic to and/or from infected IoT devices. However, in the event of yet unknown threats, the attacker's devices are not easily identified.

[0005] Therefore, there is considerable interest in developing systems and methods for collecting forensic data from various types of devices and, in particular, selectively collecting network traffic to and/or from IoT devices.

DISCLOSURE OF THE INVENTION

[0006] According to one aspect, the method comprises using at least one computer system hardware processor to intercept a Domain Name Service (DNS) response message received on the computer system, the DNS response message comprising a target Internet Protocol (IP) address indicating a network the location of the remote resource, with the DNS response message additionally containing a service activation flag. The method further comprises using at least one hardware processor of the computer system to determine, according to the value of the service activation flag, whether the security service is active, and in response, if the service activation flag indicates that the security service is active, modify the DNS response message by replacing the target IP -addresses with a fictitious IP address. The method further comprises using at least one hardware processor of the computer system to intercept electronic communication directed to the destination IP address, determine if the destination IP address matches the dummy IP address, and in response to determining if the IP address matches destination with a fictitious IP address, if the destination IP address matches the fictitious IP address, perform the computer security procedure according to electronic communication. The method further comprises using at least one hardware processor of the computer system to, in response to determining whether the destination IP address matches the dummy IP address, if the destination IP address does not match the dummy IP address, forward the electronic communication to the IP - destination address.

[0007] According to another aspect, the computer system includes at least one hardware processor configured to run a Domain Name Service (DNS) proxy and a communications manager. The DNS proxy is configured to intercept a Domain Name Service (DNS) response message received on a computer system, wherein the DNS response message contains a target Internet Protocol (IP) address indicating the network location of the remote resource, wherein the DNS response message further comprises a service activation flag . The DNS proxy is further configured to determine, according to the value of the service activation flag, whether the security service is active, and in response, if the service activation flag indicates that the security service is active, modify the DNS response message by replacing the target IP address with a bogus IP address. The communication manager is configured to intercept electronic communication directed to the destination IP address, determine if the destination IP address matches the bogus IP address, and in response, if the destination IP matches the bogus IP address, perform a computer security procedure according to electronic communication. The communication manager is further configured to, in response to determining whether the destination IP address matches the dummy IP address, if the destination IP address does not match the dummy IP address, forward the electronic communication to the destination IP address.

[0008] According to another aspect, the non-transitory computer-readable medium stores instructions that cause, when executed by at least one hardware processor of the computer system, the computer system to generate a Domain Name Services (DNS) proxy and a communications manager. The DNS proxy is configured to intercept a Domain Name Service (DNS) response message received on a computer system, wherein the DNS response message contains a target Internet Protocol (IP) address indicating the network location of the remote resource, wherein the DNS response message further comprises a service activation flag . The DNS proxy is further configured to determine, according to the value of the service activation flag, whether the security service is active, and in response, if the service activation flag indicates that the security service is active, modify the DNS response message by replacing the target IP address with a bogus IP address. The communication manager is configured to intercept electronic communication directed to the destination IP address, determine if the destination IP address matches the bogus IP address, and in response, if the destination IP matches the bogus IP address, perform a computer security procedure according to electronic communication. The communication manager is further configured to, in response to determining whether the destination IP address matches the dummy IP address, if the destination IP address does not match the dummy IP address, forward the electronic communication to the destination IP address.

[0009] According to another aspect, the server computer system participates in Domain Name Service (DNS) transactions with a plurality of client systems, wherein the server computer system comprises at least one hardware processor configured to, in response to receiving a DNS query message from the client system a plurality of client systems, wherein the DNS query message contains the name of the target domain, identify the client system according to the DNS query message. The at least one hardware processor is further configured to, in response to the client system identification, determine whether the client selection condition is satisfied according to the domain name and further according to the client system identifier. The at least one hardware processor is further configured to, in response to determining whether the client selection condition is satisfied, if the client selection condition is satisfied, send a DNS response message to the client system, wherein the DNS response message contains a target Internet Protocol (IP) address. associated with the name of the target domain, wherein the DNS response message is further configured to include a service activation flag. The at least one hardware processor is further configured to, in response to determining whether the client selection condition is satisfied, if the client selection condition is not satisfied, send another DNS response message to the client system, the other DNS response message comprising a target IP address and further configured to not include the service activation flag. The client system is configured to interpret the receipt of the service activation flag as a trigger to perform a computer security procedure according to electronic communication directed to or from the target IP address.

BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above aspects and advantages of the present invention will become more clear after reading the following detailed description with reference to the drawings, in which:

[0011] FIG. 1 shows an exemplary set of client devices protected from computer security threats, in accordance with some embodiments of the present invention.

[0012] FIG. 2-A shows a typical Domain Name Service (DNS) transaction as known in the art.

[0013] FIG. 2-B illustrates a modified DNS transaction according to some embodiments of the present invention.

[0014] FIG. 3 shows an exemplary tagged DNS query according to some embodiments of the present invention.

[0015] FIG. 4 shows an exemplary labeled DNS response according to some embodiments of the present invention.

[0016] FIG. 5-A shows an exemplary embodiment in which the client device transmits forensic data to a security server, where the forensic data contains a digest of network traffic between the client device and the content server.

[0017] FIG. 5-B shows an alternate embodiment in which at least a portion of the network traffic between the client device and the content server is rerouted through the security server.

[0018] FIG. 6 illustrates exemplary software executing on a client device in accordance with some embodiments of the present invention.

[0019] FIG. 7 shows an exemplary sequence of steps performed by a DNS proxy running on a client device, in accordance with some embodiments of the present invention.

[0020] FIG. 8 shows an exemplary sequence of steps performed by a communications manager to process outgoing communications, with the communications manager executing on a client system in accordance with some embodiments of the present invention.

[0021] FIG. 9 shows an exemplary sequence of steps performed by a communications manager to process incoming communications, in accordance with some embodiments of the present invention.

[0022] FIG. 10 shows an exemplary sequence of steps performed by a DNS server in accordance with some embodiments of the present invention.

[0023] FIG. 11 illustrates an exemplary hardware configuration of a computer system programmed to execute the methods and algorithms in accordance with some embodiments of the present invention.

IMPLEMENTATION OF THE INVENTION

[0024] In the following description, it is understood that all referenced connections between structures may be direct working connections or indirect working connections through intermediate structures. An element set includes one or more elements. Any reference to an element is intended to refer to at least one element. The set of elements includes at least two elements. Unless otherwise required, any method steps described need not be performed in the specific order shown. The first element (eg, data) derived from the second element includes a first element equal to the second element, as well as a first element generated by processing the second element and optionally other data. Making a determination or decision in accordance with a parameter includes making a determination or decision in accordance with the parameter and, optionally, in accordance with other data. Unless otherwise indicated, an indicator of some quantity/data may be the quantity/data itself or an indicator other than the quantity/data itself. A computer program is a sequence of processor instructions that perform a task. The computer programs described in some embodiments of the present invention may be stand-alone program objects or sub-objects (eg, routines, libraries) of other computer programs. A domain name is a label/alias that identifies a network address. The term "database" is used in this document to refer to any organized collection of data. Computer-readable media includes non-transitory media such as magnetic, optical, and semiconductor storage media (eg, hard disks, optical disks, flash memory, DRAM) as well as communication channels such as conductive cables and fiber optic links. In some embodiments, the present invention relates, inter alia, to computer systems comprising hardware (e.g., one or more processors) programmed to perform the methods described herein, as well as computer-readable media encoding instructions for performing the methods described herein.

[0025] The following description illustrates embodiments of the invention by way of example and not necessarily by way of limitation.

[0026] FIG. 1 shows an exemplary set of client devices 10a-f protected from computer security threats, in accordance with some embodiments of the present invention. Exemplary client systems 10a-f include personal computer systems, corporate mainframes, mobile computing platforms (e.g., laptops, tablets, mobile phones), entertainment devices (e.g., televisions, game consoles), wearable devices (e.g., smartwatches, fitness bracelets), household appliances (e.g. refrigerators, washing machines) and any other electronic device containing a processor, memory and a communication interface that allows the device to communicate with other

devices/computer systems. An exemplary client device may communicate with a remote content server 18 over a communication channel to exchange data such as web content, emails, various documents, and so on.

[0027] In the exemplary configuration of FIG. 1, client devices 10a-e are interconnected by a local area network 13 such as a local area network (LAN), home network, corporate network, and so on. Devices 10a-e may further be connected to an extended network 15 such as a wide area network (WAN) and/or the Internet. In some embodiments, at least a portion of network traffic between client devices 10a-e and extended network 15 passes through a gateway 12, such as a router or network hub. Another exemplary client device 1 Of may not be connected to the local network 13 but instead connected to the extended network 15, such as through a mobile phone network or a public Wi-Fi hotspot.

[0028] In some embodiments, a domain name service (DNS) server 14 interacts with a security server 16 to selectively collect computer forensic data from client devices 10a-f, as detailed below. Such forensic data may include, for example, metadata describing the data transfer between the selected client and the selected content server and/or the actual payload of the corresponding data transfer. Metadata in this document refers to characteristics of a transmission other than the content of the transmission or the payload itself. Exemplary metadata includes, among other things, the network addresses of the sender and/or recipient, the size of the payload, and a timestamp indicating the real time of the corresponding transmission. The term "forensic" is used in this document to indicate that the relevant data can be used for computer security purposes, for example, to determine whether the corresponding client system is infected with malware, or to prospectively identify network traffic patterns that characterize as yet unknown computer security threats. . Each of the servers 14-16 is generally a collection of communicatively connected computers, which may or may not be closely spaced. One of skill in the art will recognize that the activities performed by servers 14-16 as described herein may be split across multiple physical machines or processors.

[0029] Servers 14-16 are connected to the client profile database 19 and configured to access the database 19 to perform selective data insertion, data retrieval, and/or other database management operations. The database 19 is configured to store a plurality of client records relating to client devices 10a-f and/or users of respective client devices. In some embodiments, each client entry corresponds to a separate client device 10a-f. In one such example, the client record may store a set of identifiers for the corresponding client device (eg, media access control - MAC address, International Mobile Equipment Identity - IMEI number, etc.), a device type indicator (eg, digital camera, thermostat , smartphone, tablet, router, car), various hardware configuration indicators of the respective client device (such as whether the respective device has a camera, etc.), a list of software applications installed on the respective device, and an indicator of the geographic location of the respective client device . Other information stored in the exemplary client record includes device usage data such as network access statistics of the respective client device, such as the relative usage frequency of different communication ports, the relative amount of traffic during different time intervals, and so on. Other exemplary client records may include metadata describing network traffic transmitted or received by the respective client device. In some embodiments, such metadata may be organized according to a format such as IP Flow Information Export (IoT) (IPFIX) from the Internet Engineering Council or NetFlow® from Cisco, Inc. The database 19 may be formatted and stored according to any standard known in the art. Exemplary database formats include, but are not limited to, a relational database, an extensible markup language (XML) database, a spreadsheet, and a key-value data store.

[0030] In some embodiments, DNS server 14 provides domain name services to client devices 10a-f, the respective services including, among other things, resolving domain names to network addresses and/or vice versa. A typical data transfer between a client device and a remote content server contains several steps. Such transmission requires knowledge of the network address (eg, Internet Protocol - IP addresses) of the content server. Often this address is not known to the client for various reasons. For example, there may be multiple mirror content server machines, and the client may be dynamically directed to the most convenient one according to the current load of each mirror server, or according to the current geographic location of the client device. However, the client device may know the domain name containing the alias of the unknown network address. In order to establish a connection to a remote content server, the software object executing on the respective client device may thus issue a request to access the respective domain name instead of the IP address per se. In response, another software entity (eg, operating system) of the client device may attempt to resolve the alias/domain name to an actual network address and then forward the request to the correct network location. Such a translation may involve a DNS provider, such as server 14 in FIG. 1. FIG. 2-A illustrates a typical DNS protocol messaging as known in the art. The client device 10 sends a DNS query 22 to the DNS server 14, the query 22 containing the encoding of the domain name. In response, DNS server 14 may return a DNS response 24 to the requesting client, with response 24 including an encoding of the network address identified by the corresponding domain name/alias. Exemplary address encodings include, among others, the IPv4 and IPv6 formats.

[0031] FIG. 2-B shows an exemplary DNS exchange between client device 10 and DNS server 14, in accordance with some embodiments of the present invention. Unlike conventional DNS exchange (FIG. 2-A), in some embodiments, client device 10 may send a tagged DNS query 26 to DNS server 14, the tagged query containing the identity of the corresponding client device 10. An exemplary tagged query 26 is depicted in FIG. . 3 and includes encoding of domain name 21 and client ID 25. The client ID 25 may contain any element that distinguishes the client device 10 from other client devices. Exemplary client IDs include hash, MAC address, IMEI number, and so on. In some embodiments, the client ID 25 may not allow the client device 10 to be individually identified, but nevertheless indicates the group identifiability of the corresponding client device. For example, client ID 25 can selectively specify a group of devices (e.g., devices in a particular department of a corporation, devices located in a particular network subdomain, devices belonging to a particular home network, devices protected under a particular service contract), device type ( e.g. smartphones versus desktops versus built-in PCs), etc.

[0032] In an alternative embodiment, the client ID 25 may contain a client device profile digest. The exemplary device profile information may include, for example, encodings of the device type, operating system, current geographic location, and current user ID of the respective client device. Such information may be used by the DNS server 14 and/or the security server 16 to select the appropriate client device to activate/deactivate security services, as shown in more detail below.

[0033] In response to receiving a tagged DNS query 26, some embodiments of the DNS server 14 return a tagged DNS response 28, an example of which is shown in FIG. 4. The tagged DNS response 28 includes a network address encoding 23 and a service activation flag 27 indicating whether a particular security service is active for the corresponding requesting client device 10. Exemplary security services selectively enabled/disabled by flag 27 include forensic data collection , parental controls (for example, restricting certain users from accessing certain domains), application control (for example, preventing certain applications from running, such as Facebook®, instant messaging, games, etc.), fraud protection, malware protection , traffic inspection, etc.

[0034] In an alternative embodiment, the tagged DNS response 28 may include a plurality of service activation flags, such as a bitmap, with each bit representing a different security service (e.g., parental control, traffic inspection, forensic intelligence, etc.). ), and the value of the corresponding bit indicates whether the corresponding service is enabled or disabled. In another example, the labeled DNS response 28 may include a set of service parameter values along with or instead of a simple service activation flag. In yet another example, individual values of the service activation flag 27 may indicate different modes of operation of the target client device. For example, one value may instruct the client device to allocate appropriate traffic (eg, interpret a 28 DNS response as an NXDomain response), while another value may instruct the client device to force a timeout or redirect traffic to a different IP address.

[0035] Data elements such as client ID 25 and service activation flag ID 27 may be encoded and included in client requests and/or server response messages using any method known in the art. Many modern protocols/data formats used in electronic communication reserve a set of selected bits of each data packet for non-specific use. Various embodiments may use such reserved bits to encode the client ID 25 and/or the service activation flag 27 . In the simplest example, the selected bit of the corresponding message can act as a service activation flag; a value of 1 may indicate that the service is enabled, while a value of 0 may indicate that the service is disabled, or that the associated message is unflagged. Some embodiments use DNS messages formatted according to a currently used standard, such as, among others, as described in Internet Engineering Task Force (IETF) Request for Comments (RFC) 1035. In one such example, the client ID 25 and/or service activation flag 27 may be inserted as an additional resource record or a DNS query or response pseudo-resource record, such as the contents of an RDATA field.

[0036] In some embodiments, the implementation of the DNS server 14 can selectively activate/deactivate the security service by appropriately setting the value of the service activation flag 27 only for certain client devices and/or users. The decision to allow or not to allow a particular service can be made by the security server 16 according to the ID of the client device issuing the corresponding tagged DNS query, and further according to criteria such as the current geographical location of the client device, device type, profile hardware and/or software of the respective client device. Examples of decision algorithms and criteria are shown below. To enable such decision algorithms, some embodiments collect device profile information from client devices and pass such profile information to the security server 16, which may organize and store it in the client profile database 19 (see FIG. 2-B).

[0037] Some embodiments use a service activation flag 27 to selectively collect forensic data, as shown in more detail below. In response to selecting a client device as a target for data collection, DNS server 14 may respond to a DNS query received from the corresponding client device with a labeled DNS response in which a service activation flag 27 is set to indicate that data collection is allowed. In response to receiving an appropriate labeled DNS response, the security application running on the selected client device may collect forensic information from the selected device and pass the corresponding information to the security server 16 for analysis. Forensic data collection can occur according to several scenarios. In one example shown in FIG. 5-A, security software running on client device 10 may determine the metadata and/or actual payload of the communication between client device 10 and content server 18, package information such as forensic data 30, and add it to the outgoing message queue for transmission. to the security server 16. In another example shown in FIG. 5-B, in response to receiving a labeled DNS response indicating that data collection is active, security software running on the corresponding client device may reroute at least a portion of the data traffic between client device 10 and content server 18 via a communication tunnel connecting the client device 10 to the security server 16 . An example of such a tunnel is a virtual private network (VPN) connection. In other words, in FIG. 5-B, forensic data collection comprises routing direct communications to and/or from selected client devices through a security server 16 where the relevant traffic can be analyzed.

[0038] FIG. 6 shows exemplary software components executing on a client device in accordance with some embodiments of the present invention. Such software may include an operating system (OS) 50, which may be any widely available operating system such as Microsoft Windows®, MacOS®, Linux®, iOS®, or Android®. OS 50 provides an interface between client device 10 hardware and a set of applications, including client application 52 and security application 54. The client application 52 is generally any computer program such as, but not limited to, a word processing application, a spreadsheet application, image processing, gaming, electronic communication, web browsing, and a social networking application. The security application 54 provides computer security services to the client device 10, such as anti-malware, intrusion detection, and network access control.

[0039] In some embodiments, the security application comprises a DNS proxy 56, a profile builder 57, and a communication manager 58. The components 56-57-58 may run as stand-alone executables or may be embedded within the security application 54, such as as dynamic link libraries. One skilled in the art will appreciate that some of the functions of the components 56-57-58 may be implemented on the network gateway 12 (see FIG. 1) instead of the client system 10.

[0040] In some embodiments, the DNS proxy 56 is configured to mediate between the client device 10 and the DNS server 14 in that the DNS proxy 54 intercepts and modifies the flow and/or content of DNS messages incoming and/or outgoing from the client device. devices 10. Some embodiments configure the OS 50 to selectively route outgoing traffic to specific IP addresses through the DNS proxy 56 . Such functionality can be implemented, for example, using a split tunneling VPN. In one such example, security application 54 may register the IP address(es) of OS 50 DNS server 14, thereby declaring server 14 to be the DNS provider for the respective client system. The application 54 may further configure the VPN interface of the client system 10 such that all traffic to the respective IP addresses will go through the DNS proxy 56 .

[0041] FIG. 7 shows an exemplary sequence of steps performed by a DNS proxy 56 according to some embodiments of the present invention. The exemplary algorithm described in this document provides selective processing of network access queries, with the selection achieved at the level of detail of a single DNS query.

[0042] The sequence of steps 202-204 intercepts incoming and outgoing DNS messages. At step 206, the DNS proxy determines the type of intercepted message. If the message is a DNS request (for example, a client application 52 request to access a specific domain name), in the sequence of steps 208-210, the DNS proxy 56 tags the corresponding DNS request with the client ID of the corresponding client device to create a tagged DNS request 26 and transmits the request 26 to DNS server 14.

[0043] If the intercepted DNS message is a response, step 220 analyzes the message to determine if it is tagged or not, that is, if it contains a service activation flag and if the value of the flag indicates that the security service is active for the corresponding client device 10. If not, step 222 forwards the appropriate DNS response to the requesting software entity (eg, client application 52 or OS 50).

[0044] In some embodiments, security application 54 maintains a pool of predefined dummy network addresses reserved for security purposes. In this document, bogus addresses are used as replacements for the actual network addresses returned by DNS providers. A fictitious address may or may not indicate the location of a real online resource. The security application 54 maintains an address association table (eg, a hash table) containing the conversion between real and bogus addresses, as shown below. In some embodiments, security application 54 further registers bogus IP addresses with client system 10's VPN interface such that all traffic to and/or from such bogus addresses will go through security application 54. This allows the communication manager 58 to perform security operations on such traffic, for example, to redirect or inspect such traffic, as described in more detail below. Separate dummy addresses can be used for various services such as parental control, traffic sampling, access control, etc.

[0045] If the intercepted DNS message is a labeled response, and the value of the flag indicates that the security services are active, then at step 224, an available dummy address is selected from the pool. Some embodiments select the dummy address further according to the value of the service activation flag 27, for example, when different values indicate the activation of different services. The DNS proxy 56 may then create an association between the corresponding dummy address and the actual network address contained in the DNS response (eg, a hash table entry that maps the dummy address to the real address or vice versa). The next step 228 may edit the tagged DNS response to replace the actual network address with the selected dummy address. At block 228, some embodiments further remove the service activation flag from the corresponding DNS message to make it look like a standard DNS response. Such obfuscation strategies can help hide security software activity from potential malicious code executing on client device 10. The next step 230 transmits a modified DNS response to the requesting software entity (eg, client application 52 or OS 50).

[0046] In some embodiments, the communication manager 58 intercepts and processes at least a portion of the electronic communications between the client device 10 and the content server 18. As shown above, some embodiments configure the security application 54 to intercept communications coming from and/ or outgoing to a predefined set of IP addresses. Fig. 8 shows an exemplary sequence of steps performed by the communication manager 58 to process outbound communications, such as Hypertext Transfer Protocol (HTTP) requests to the content server 18. If such communication is detected (steps 242-244), step 246 determines if the IP the destination address of the corresponding communication with any of the list of dummy IP addresses maintained by the security application 54 . If not, the communication manager 58 may forward the communication to the communication interface of the client system 10 for transmission to the intended recipient.

[0047] If yes, indicating that the corresponding communication has been selected for security processing, step 248 performs some security actions according to the corresponding communication. Exemplary security actions include defining a set of metadata containing, for example, a real destination IP address associated with a corresponding dummy address, a communication port, a payload size, and a communication timestamp. Another security action may comprise making a copy of the payload of the corresponding communication. Another exemplary security action comprises checking the communication payload to determine if the corresponding payload is encrypted or not, or if the corresponding payload contains a certain type of data (eg, image, executable code, etc.). In yet another example, step 248 comprises scanning the corresponding communication payload for malicious code. In some embodiments, step 248 further comprises placing the information retrieved about/from the respective communication into a log or queue for offline transmission to the security server 16. Some embodiments determine the type of security action according to the dummy address. For example, some bogus addresses may indicate a parental control action, while another bogus address may indicate a malware scan.

[0048] In an additional step 252, the communication manager 58 may look up the address association table to determine the real IP address corresponding to the dummy address specified in the corresponding communication and edit the corresponding communication to replace the dummy address with the real IP address. In some embodiments, step 252 may further repackage the original communication to reroute it through the VPN tunnel to the security server 16 (see FIG. 5-B). Step 254 may then forward the communication to the communication interface of the client device 10.

[0049] FIG. 9 shows an exemplary sequence of steps performed by the communications manager 58 when processing incoming communications. When such a communication is received (steps 262-264), step 266 may look up the address association table to determine if the source IP address of the communication matches the dummy address. If not, the communication manager 58 may forward the incoming communication to its intended recipient (eg, application 52).

[0050] If yes, indicating that the appropriate communication is selected for security processing, step 268 performs a set of security actions in accordance with the incoming communication. Exemplary security actions include determining a set of communication metadata (e.g., start IP address, payload size, timestamp, etc.), copying the payload of the corresponding communication, checking the payload to determine the set of characteristics (e.g., whether the corresponding payload, whether it contains executable code, etc.), and scanning the corresponding payload for malicious code, among other things. Some embodiments may further transmit such information to the security server 16 .

[0051] At step 272, the communication manager 58 may then edit the incoming communication to replace the original IP address with the associated dummy IP address. An additional step 274 may then forward the edited communication to its intended recipient (eg, client application 52).

[0052] In some embodiments, the profile builder 57 (FIG. 6) is configured to determine various hardware and/or software configuration characteristics of the client device 10 and to communicate such data in the form of a profile indicator 29 to the security server 16 (FIG. 2- AT). Exemplary hardware characteristics may include, for example, the device type of the corresponding client device (e.g., smartphone, PC, tablet computer, thermostat), identification characteristic (e.g., MAC address, IMEI, etc.), hardware specifications of various component (eg, manufacturer, model), an indication of whether the corresponding client device 10 has a specific hardware component (eg, camera, microphone, fingerprint reader, global positioning system-GPS sensor, etc.). Other exemplary hardware characteristics include the amount of resource currently in use (eg, CPU throttling, RAM and disk usage, active screen time). Exemplary software characteristics include, but are not limited to, OS 50 type and version, a list of currently installed software applications, and statistics indicating how much each application is used on the respective device. The profile indicator 29 may further include an indicator of the client device's current geographic location (eg, country, geographic coordinates, etc.). In response to receiving the profile indicator 29, the security server 16 may store such information in the client profile database 19 . In some embodiments, client profile information is used to select a client device from a plurality of client devices for security services, such as forensic intelligence, as described below. For example, such profile information may provide clues as to which devices may be infected with malware.

[0053] FIG. 10 shows an exemplary sequence of steps performed by a DNS server 14 according to some embodiments of the present invention. The sequence of steps 282-284 intercepts DNS requests. In some embodiments, such requests are tagged with a client identifier (see the description above with respect to FIG. 7). When a request is received, step 286 identifies the client device on which the corresponding request was created according to client ID 25 (see, for example, FIG. 3). In an additional step 288, the DNS server 14 may look up the client profile of the corresponding client device in the profile database 19 .

[0054] Step 290 may further determine if a service activation condition is satisfied for the current DNS query and the corresponding client device. In other words, at step 290, the server 14 may selectively activate the security service for some clients and/or some domain names. The selection of the client may take place according to the client profile data retrieved from the database 19 . In an alternative embodiment in which the DNS proxy 56 sends the client profile data encoded in the tagged DNS request 26, the server 14 may select an appropriate client device in accordance with such data. In yet another embodiment, steps 288-290 are performed by the security server 16, which then transmits the list of selected client devices to the DNS server 14.

[0055] In an exemplary forensic data collection embodiment, DNS server 14 may select clients corresponding to a particular device type (eg, smartphones), clients from a particular region or country (eg, Germany), clients running a particular operating system, and /or version (e.g. Android, iOS 10), etc. Another exemplary client selection criterion includes whether the respective client device runs a particular application, such as unknown or suspicious software. In one such example, HTTP requests to access IP addresses associated with specific domain names from devices running a particular monitored application can be replicated or redirected via the VPN to the security server 16 .

[0056] Other client selection criteria may include client device counts and/or DNS queries. For example, DNS server 14 may select a predetermined number of client devices during each time interval (e.g., no more than 100 distinct clients per second) or a predetermined number of DNS queries (e.g., no more than 50 distinct DNS queries from the same client). ). In the embodiment depicted in FIG. 5-B, in which the client device can selectively reroute certain communications to the security server 16 through the VPN tunnel according to the value of the service activation flag, another exemplary selection criterion includes the current load of the VPN service running on the security server 16. In an exemplary parental control embodiment, another selection criterion may include the current user of the respective client device (eg, activate parental control rules selectively only when children are using the device). The individual selection criteria can be combined into complex criteria including multiple conditions (eg 100 DNS queries received from various smartphones in Belgium and the Netherlands).

[0057] If the selection condition is satisfied for the client device issuing the current DNS query, step 294 may formulate a labeled DNS response by setting a service activation flag 27 to indicate that the security service is active (see, for example, FIG. 4). In some embodiments, setting flag 27 to active effectively selects the appropriate client device for a particular security service, such as forensic collection, parental controls, and so on. This selection is enabled here on a DNS request, and can be disabled for subsequent requests received from the same client device.

[0058] When the selection conditions are not satisfied for the respective client device and the current DNS query, step 296 may formulate a labeled DNS response by setting an activation flag 27 to indicate that the security service is inactive. In an alternative embodiment, step 296 may formulate a standard DNS response in which the service activation flag 27 is completely absent. The next step 298 may send the DNS response formulated in step 294 or 296 to the requesting client device.

[0059] The above description shows exemplary computer programs that perform various methods according to some embodiments of the present invention. Such computer programs are typically executed by a general purpose hardware processor, however, those skilled in the art will appreciate that the methods and algorithms disclosed herein may be implemented using specialized hardware components such as an application specific integrated circuit (ASIC) or field programmable gate array (FPGA). Fig. 11 illustrates an exemplary hardware configuration of a computer system programmed to execute the methods and algorithms described herein. Fig. 11 shows a general computer system, which may be, for example, any of the client devices 10a-f, a DNS server 14, and a security server 16, among others. The skilled artisan will appreciate that the hardware configuration of some client systems (eg, mobile phones, smartwatches) may differ slightly from that shown in FIG. 11 configurations.

[0060] The depicted computer system includes a collection of physical devices, including a hardware processor 32 and a memory unit 34. The processor 32 includes a physical device (eg, a microprocessor, a multi-core integrated circuit implemented on a semiconductor substrate, etc.) configured to perform computational and/or logic operations on a set of signals and/or data. In some embodiments, such operations are delivered to processor 32 in the form of a sequence of processor instructions (eg, machine code or other type of encoding). Memory unit 34 may include a volatile computer-readable medium (eg, DRAM, SRAM) that stores instructions and/or data that is accessed or generated by processor 32.

[0061] Input devices 36 may include, among other things, computer keyboards, mice, and microphones, including appropriate hardware interfaces and/or adapters that allow a user to enter data and/or instructions into an appropriate computer system. Output devices 38 may include display devices such as monitors and speakers, among other things, as well as hardware interfaces/adapters, such as graphics cards, to allow the depicted computer system to communicate data to a user. In some embodiments, input devices 36 and output devices 38 share common hardware, as is the case for touch screen devices. The storage devices 42 include computer-readable media for non-volatile storage, reading and writing of program instructions and/or data. Examples of storage devices 42 include magnetic and optical disks and flash memory devices, as well as removable media such as disks and CD and/or DVD drives. The set of network adapters 44, together with the associated communication interface(s), allows the depicted computer system to be connected to a computer network and/or to other devices/computer systems. Controller hub 40 is a plurality of system, peripheral, and/or chipset buses, and/or all other circuitry enabling communication between processor 32 and devices 34, 36, 38, 42, and 44. For example, controller hub 40 may include includes, among other things, a memory controller, an input/output (I/O) controller, and an interrupt controller. In another example, controller hub 40 may include a northbridge connection processor 32 to memory 34 and/or a southbridge connection processor 32 to devices 36, 38, 42, and 44.

[0062] The exemplary systems and methods described above enable computer security operations to be selectively performed on heterogeneous clients such as personal computers and smartphones, as well as Internet of Things (IoT) devices such as televisions, thermostats, refrigerators, and wearable devices, among others. Selectivity in this document refers to the ability to accurately selectively select a device from a plurality of client devices and perform some security procedure on the corresponding device, as opposed to indiscriminately perform the corresponding security procedure on a plurality of client devices. In some embodiments, target device selection is centralized on a remote server computer system communicatively coupled to a plurality of client devices.

[0063] In some embodiments, the security application runs on each client device and includes a Domain Name Service (DNS) proxy that intercepts and processes DNS messages exchanged between the respective client device and a remote DNS server. For clarity and simplicity, the above disclosure uses the term "Domain Name Service" to refer to the conventional DNS currently used in Internet communications. However, the skilled artisan will appreciate that the methods and systems described herein can be easily adapted to any other format and protocol for converting a domain name to a network address or vice versa.

[0064] In some embodiments, the DNS proxy component tags outgoing DNS queries addressed to the DNS server with the identifier of the corresponding client device. In response, the DNS server may respond with a tagged DNS response containing a service activation flag. In some embodiments, the DNS server selects a particular client device for security by setting the service activation flag to a predetermined value when issuing a DNS response to the appropriate client. In turn, the security application running on the client may interpret certain values of the service activation flag as a trigger for the execution of the appropriate security procedure. Different flag values can trigger different security procedures. In an alternative embodiment, the presence of a service activation flag in the DNS response may trigger security procedures, while the absence of such a flag may instruct the security application not to perform the appropriate procedures.

[0065] In view of the foregoing, the exemplary systems and methods described above achieve client selectivity at the level of individual DNS messages. In other words, the security procedures can be resolved/not resolved by any single DNS exchange between the respective client device and the DNS server. In some common computer security applications, clients are selected for certain procedures according to individual client subscription options or according to software configuration settings. For example, some clients may subscribe to parental controls while others may not. Similarly, some client traffic may be routed through the VPN tunnel by security software, but not others. However, this client selectivity is usually predetermined and does not change over time, eg all access requests coming from a particular client are usually processed according to the same rule/procedure. Unlike such conventional systems, some embodiments allow more flexible client selection to be performed on a per DNS message basis. This allows, for example, to select a client for a specific procedure according to the schedule, according to the current load on the server, according to the domain name the client is trying to access, according to the client's current geographic location (for example, setting geofences), and others

[0066] Exemplary security procedures selectively activated in accordance with some embodiments of the present invention include, but are not limited to, selective collection of forensic information from clients, selective routing of traffic through a security server, parental controls (e.g., selective monitoring and/or restricting access to certain clients/users to certain online content), application or access control (eg selective monitoring and/or restriction of the client's use of selected applications and/or communication protocols such as Facebook® and online messaging).

[0067] An important class of applications provided or supported by some embodiments of the present invention is based on the selective collection of computer forensic data from clients. Such a collection can be useful, for example, for the timely detection of emerging computer security threats, such as malicious code. New malicious software appears all the time, and without information about its behavior, such software can bypass normal security measures and spread quickly. IoT devices are particularly vulnerable to such infections. Therefore, it is important to collect as much information as possible about emerging infections, and ideally collect such information selectively from already infected devices. Some malicious code selectively infects devices of a certain type (eg mobile phones) and/or devices running a certain type of operating system (eg AFndroid®). Some embodiments enable such selective targeting of clients and hence efficient collection of information for security purposes. In one such example, a DNS server may select a client device that matches a likely target profile for a particular malicious code (eg, a smartphone from a particular country). In response, the security software running on the selected client device may take a snapshot of the data traffic incoming/outgoing from the respective client device. By allowing selective activation of data collection for each DNS message, some embodiments allow data traffic to be collected to or from a particular Internet domain or network address of interest (eg, a suspect command and control server).

[0068] An alternative collection of data may redirect to the security server communication between the selected client device and the suspect Internet domain or network address. Such redirection may be allowed, for example, using a VPN tunnel. The security server can then analyze the redirected traffic for malicious activity. Rerouting and inspection of network traffic are known in the field of computer security. However, typical configurations reroute all traffic of the selected client, thereby ensuring that it is always protected from online threats. Such a massive network of rerouting traffic from thousands of secure clients to a small number of VPN servers is relatively costly in terms of hardware costs and computational load, and can negatively impact the user experience on the client side. Unlike such conventional systems, in some embodiments of the present invention, the traffic of each client device can be selectively rerouted through the VPN. For example, in a data collection embodiment, only traffic to/from certain domains of interest may be redirected to the VPN servers. In addition, the systems and methods described herein allow random sampling of network traffic from a plurality of client devices that match a particular profile (eg, iOS® smartphones and tablets). This random sampling can ensure that no particular client device is disproportionately impacted by data collection procedures, while the overall impact on the user experience is significantly less than in traditional systems.

[0069] Some embodiments may use a tagged DNS response as a trigger to collect other forensic data. In one such example, in response to a labeled DNS response, the security software may determine the parameters of the current state of the respective client device (eg, obtain the current value of various OS variables and/or registry keys, take a snapshot of a particular section of memory, etc.). Such data can be transferred to a security server and used in forensic investigations along with network traffic data.

[0070] An exemplary use case for the systems and methods described herein includes proactive detection of spyware. An outbreak of new malware has been discovered in Western Europe that is targeting devices running the Android® operating system. The malicious code is delivered via the Google Play® Store, packaged as an original photo organizing tool. However, the hidden purpose of the application is to collect the user's personal data and send it to the server. This is technically considered spyware.

Stage I - initiation of suspicion of malignancy.

[0071] Client devices secured according to some embodiments of the present invention send various DNS queries and client profile information to DNS server 14 and/or security server 16 (see FIG. 2-B). The client profile indicator 29 may include a list of applications currently installed on the device. Based on this information, the installation of an unknown application is detected. In addition, a record of DNS requests received from this client device reveals frequent requests to access the domain name upload application name.serviceprovider.com. The security server 16 runs a series of malicious code heuristics in the DNS logs, detecting that the serviceprovider.com domain is registered as a Service Provider (PAS) by the platform and that DNS requests for the corresponding domain are received at relatively regular intervals. These two facts raise the suspicion of maliciousness, and the security server 16 decides to sample and/or inspect the network traffic exchanged between the respective client device and the suspicious domain.

Stage II - traffic analysis

[0072] To collect a representative sample of traffic, the security server 16 identifies a selected subset of client devices considered representative of this threat in accordance with the device profiles stored in the profile database 19 . For example, the selection may be made according to the candidate device's current location in (eg, Western European countries) and operating system (in this case, a specific version of Android®). The security server 16 may send a list of selected devices to the DNS server 14. In response, the DNS server 14 may flag at least some of the DNS responses to DNS requests containing the serviceprovider.com domain received from the selected clients to indicate activation of the forensic collection service. data on the respective devices. In some embodiments, the value of the service activation flag 27 instructs the security software on the receiving client device to redirect traffic to serviceprovider.com over the VPN to the security server 16 . The DNS server 14 will keep track of each selected client device, for example, record how many DNS serviceprovider.com requests have been received from the respective client device, and stop collecting forensic data from the respective client device when enough traffic samples have been collected. To stop data collection, the DNS server 14 may reset the service activation flag 27 to indicate that the data collection service is inactive, or may respond with a standard DNS response that does not include the service activation flag 27 at all.

[0073] In turn, in response to receiving a labeled DNS response indicating that forensic data collection is active, the security software running on the client device replaces the real IP address corresponding to serviceprovider.com with a bogus IP address. Then, when the suspected malware attempts to contact serviceprovider.com, it will send a connection request to a bogus IP address. Such a request may be rerouted through the VPN interface of the client device to the security server 16 . Rerouting typically involves replacing the bogus IP address with the corresponding real destination IP address and repackaging the network traffic according to the VPN protocol. Some embodiments of the security application 54 additionally attach some metadata (eg, destination port, destination IP address, network protocol, timestamp, etc.) to the redirected traffic.

[0074] In an exemplary traffic analysis scenario, the VPN component of the security server 16 logs the metadata attached to each received network packet and saves a copy of the packet's payload to disk for later verification. The packet itself is then forwarded to its true destination IP address. Any response packet from the corresponding IP address will be forwarded back to the corresponding client device. In some embodiments, the VPN component of the security server 16 will also log incoming traffic destined for the respective client device, thus intercepting the full exchange between the suspected malware and its remote service providers.

[0075] Using some of the systems and methods described herein, computer security analysts were able to collect the following types of information:

- telemetry to identify the outbreak of a new potentially malicious application;

- a suspicious web service identified by a suspicious domain name; and

- samples of data exchanged between a new unknown application and a suspicious domain name.

[0076] Using this data, the analysis team was able to apply heuristics to determine that the web service in the suspect domain is being used for malicious command-and-control communications. This rough definition of maliciousness was made according to the timing and frequency of packet exchanges, the fact that messages are encrypted, the identity of the owner of the encryption key, and the average size of the communication payload (relatively small packets). Another set of heuristics identified the suspicious domain as a malicious downloader (user data collector) according to the asymmetry of the exchanges (the payload of packets originating on the client device is usually much larger than the payload of incoming packets), and the fact that such asymmetric traffic has been seen only on some of the infected clients, suggesting that the affected clients were somehow chosen by the C&C server as being of interest.

[0077] Several systems and methods are known in the art for using DNS messages to selectively target individual clients for specific services. However, in conventional systems and methods, typically, the entity performing the corresponding service is the DNS server itself. In a parental control example, in response to receiving a DNS query tagged with a client ID, the DNS server can selectively choose whether or not to return an IP address according to the client ID and/or domain name requested. In the load balancing example, the DNS server may choose among a plurality of IP addresses according to the current geographic location of the requesting client.

[0078] Unlike such conventional systems, in some embodiments of the present invention, security tasks are divided between software running on the DNS server and software running on the client device. For example, the task of selecting a client for a particular service is performed by a DNS server communicating with the requesting client device via a labeled DNS response. In turn, the security software running on the client actually performs the corresponding service (eg collection of forensic data, redirection of traffic to the security server, parental control, etc.). This separation of concerns has several advantages. On the one hand, the centralization of the decision-making process on the server provides comprehensive management of security information and optimal speed of response to emerging threats. On the other hand, performing security operations on the client itself can improve the accuracy, complexity, and flexibility of security operations. Thus, virtually any operation can be performed on the client while taking advantage of the per-DNS per-message selection described above. For example, selective redirection of client network traffic over a VPN to a security server is possible using the systems and methods described in this document, while it cannot be performed by a single DNS server, i.e. using the normal DNS server-centric security model.

[0079] Although the above description is mainly focused on embodiments in which security software such as DNS proxy 56 and communication manager 58 runs on the end client device (e.g., smartphone, PC), in alternative embodiments, at least At least some of the functions of DNS proxy 56 and/or manager 58 may be implemented on a network device acting as a gateway to a local area network connecting multiple client devices. See, for example, gateway 12 in FIG. 1. In such configurations, gateway 12 may intercept DNS messages entering and/or leaving local network 13 and may modify them as shown above. When gateway 12 provides clients with LAN addresses (eg, acting as a DHCP server for LAN 13), gateway 12 distinguishes between individual client devices and can therefore tag outgoing DNS requests with the appropriate client ID. In addition, gateway 12 is in a position to intercept and selectively route other electronic communications (eg, HTTP requests) between clients on the local network and external IP addresses. Therefore, gateway 12 can perform the security procedures shown herein, such as selective forensic data collection, parental control actions, and so on.

[0080] Some embodiments implement a hybrid configuration in which some of the client devices 10a-f execute an instance of the security application 54 and others do not. In one such example, gateway 12 may attempt to automatically provision security application 54 to all client devices 10a-e connected to local network 13. Some such devices, such as thermostats, smartwatches, etc., may have limited hardware resources and, therefore, cannot run a full instance of the security application 54. Some embodiments may then use software running on gateway 12 to extend the security services described herein to such devices.

[0081] Numerous benefits can be obtained by running at least a portion of the functionality of the security application 54 on the gateway 12 as opposed to the end client devices 10a-f as shown above. One advantage is that operations performed on gateway 12 (such as tagging DNS queries, discovering service activation flags, modifying IP addresses, etc.) are virtually undetectable by software running on client devices. In addition, malicious code executing on client devices cannot interfere with or disrupt the gateway 12. without redirecting the relevant traffic to the VPN server. In one such example, gateway 12 may determine traffic metadata (eg, start and destination IP addresses, packet size, timestamps) and pass such metadata to security server 16 for analysis.

[0082] Another benefit of configurations in which at least a portion of the security application 54 runs on the gateway 12 is an understanding of the local network topology. In the example in FIG. 1 DNS server 14 does not normally know that client devices 10a and 10b are connected to the same local network, but gateway 12 does. Therefore, when intercepting multiple DNS requests for the same domain name, gateway 12 can inform server 14 whether the corresponding DNS requests originate from members of the same network or not. Such information is potentially relevant to computer security, for example, in situations where malicious code is distributed from one network node to another. In another exemplary situation, multiple DNS queries for the same domain name from different types of devices (smartphones, PCs, TVs) connected to the home network may indicate legitimate use of an online entertainment service such as Spotify® or Netflix®. In yet another example, multiple DNS requests for the same domain name from devices running the same OS (eg, Windows®) may indicate a legitimate attempt to distribute a software update to multiple devices on a corporate network.

[0083] However, running at least part of the security application 54 on the gateway 12, as opposed to individual client devices, also has disadvantages. For example, automatic device discovery (ie, using software running on gateway 12 to determine the device type of each client 10a-f) can be limited and computationally expensive. While some client type information may be available in the form of MAC addresses, etc., other data, such as resource usage and installed software, may not be entirely available to gateway 12.

[0084] Those skilled in the art will appreciate that the above embodiments may be varied in many ways within the scope of the invention. Accordingly, the scope of the invention is to be determined by the following claims and their legal equivalents.

Claims (55)

1. A method of using Domain Name Service (DNS) messages to selectively collect computer forensic data, comprising using at least one computer system hardware processor to: intercept a Domain Name Service (DNS) response message received on the computer system, the DNS response message comprising a target Internet Protocol (IP) address indicating the network location of the remote resource, the DNS response message further comprising a service activation flag; determine, according to the value of the service activation flag, whether the forensic data collection service is active; in response, if the service activation flag indicates that the forensic intelligence service is active, modify the DNS response message by replacing the target IP address with a bogus IP address; intercept electronic communication directed to the destination IP address; determine if the destination IP address matches the dummy IP address; in response to determining whether the destination IP address matches the bogus IP address, if the destination IP matches the bogus IP address, perform a forensic data collection procedure to characterize the emerging malicious code, the forensic data collection procedure comprising transmitting a set of metadata, characterizing electronic communication to a remote security server. 2. The method of claim 1, wherein performing the forensic data collection procedure further comprises using at least one hardware processor to reroute electronic communication through a tunnel connecting the computer system to the remote security server. 3. The method of claim 1, wherein the metadata set includes a target IP address and an electronic communication timestamp. 4. The method of claim 3, wherein the metadata set further comprises an electronic communication payload size indicator. 5. The method of claim 1, wherein performing the forensic data collection procedure further comprises using at least one hardware processor to reroute electronic communication through a tunnel connecting the computer system to the remote security server. 6. The method of claim 1, wherein the forensic data collection procedure further comprises transmitting a current state indicator of a client system selected from a plurality of client systems according to whether the electronic communication originates from the client system. 7. A computer system for using Domain Name Service (DNS) messages for selective collection of computer forensic data, comprising at least one hardware processor configured to perform a Domain Name Service (DNS) proxy and a communication manager, wherein: The DNS proxy is configured to: intercept a DNS response message received in the computer system, wherein the DNS response message contains a target Internet Protocol (IP) address indicating the network location of the remote resource, wherein the DNS response message further comprises a service activation flag, determine, according to the value of the service activation flag, whether the forensic data collection service is active, and in response, if the service activation flag indicates that the forensic intelligence service is active, modify the DNS response message by replacing the target IP address with a bogus IP address; and the communication manager is configured to: intercept electronic communication directed to the destination IP address, determine whether the destination IP address matches the bogus IP address, and in response to determining whether the destination IP address matches the bogus IP address, if the destination IP address matches the a fictitious IP address, perform a forensic data collection procedure to characterize the emerging malicious code, wherein the forensic data collection procedure comprises transmitting a set of metadata characterizing electronic communication to a remote security server. 8. The computer system of claim 7, wherein the metadata set includes a target IP address and an electronic communication timestamp. 9. The computer system of claim 8, wherein the metadata set further comprises an electronic communication payload size indicator. 10. The computer system of claim 7, wherein the forensic data collection routine further comprises transmitting a current state indicator of a client system selected from a plurality of client systems according to whether the electronic communication originates from the client system. 11. A non-transitory computer-readable medium that stores instructions causing, when executed by at least one hardware processor of the computer system, the computer system to form a Domain Name Services (DNS) proxy and a communications manager, wherein: The DNS proxy is configured to: intercept a DNS response message received in the computer system, wherein the DNS response message contains a target Internet Protocol (IP) address indicating the network location of the remote resource, wherein the DNS response message further comprises a service activation flag, determine, according to the value of the service activation flag, whether the forensic data collection service is active, and in response, if the service activation flag indicates that the forensic intelligence service is active, modify the DNS response message by replacing the target IP address with a bogus IP address; and the communication manager is configured to: intercept electronic communication directed to the destination IP address, determine whether the destination IP address matches the bogus IP address, and in response to determining whether the destination IP address matches the bogus IP address, if the destination IP address matches the a fictitious IP address, perform a forensic data collection procedure to characterize the emerging malicious code, wherein the forensic data collection procedure comprises transmitting a set of metadata characterizing electronic communication to a remote security server. 12. A server computer system for using Domain Name Service (DNS) messages to selectively collect computer forensic data, comprising at least one hardware processor configured to participate in Domain Name Service (DNS) transactions with multiple client systems and further configured to: in response to determining the suspicion of an Internet domain for malware, determine the target device profile in accordance with the Internet domain, and the profile of the target device in the aggregate is representative of electronic devices characterized by being located within the selected geographic area and executing the selected operating system; in response to receiving the DNS query message containing the Internet domain, identify, in accordance with the DNS query message, the client system from which the DNS query message originates; in response to identifying the client system, determine if the client system matches the profile of the target device; in response to determining if the client system matches the profile of the target device, if the client system matches the profile of the target device, send a DNS response message to the client system, wherein the DNS response message contains the target Internet Protocol (IP) address associated with the domain name , wherein the DNS response message is further configured to include a service activation flag; and in response to determining if the client system matches the profile of the target device, if the client system does not match the profile of the target device, send another DNS response message to the client system, the other DNS response message containing the target IP address and further configured not to include a service activation flag; wherein the client system is configured to interpret the receipt of the service activation flag as a trigger to perform a forensic data collection procedure according to electronic communication directed to or incoming from the target IP address. 13. The server computer system of claim 12, wherein the at least one hardware processor is further configured to: in response to determining whether the client system matches the profile of the target device, if the client system matches the profile of the target device, determine whether the client system is authorized to perform forensic data collection according to a counter of DNS query messages previously received from the client system; and in response, send a DNS response message including the service activation flag only when the client system is authorized to perform forensic data collection. 14. The server computer system of claim 12, wherein the at least one hardware processor is further configured to: in response to determining whether the client system matches the profile of the target device, if the client system matches the profile of the target device, to determine whether the client system is authorized to perform forensic data collection according to a counter of DNS query messages including a domain name previously obtained in the server computer system; and in response, send a DNS response message including the service activation flag only when the client system is authorized to perform forensic data collection. 15. The server computer system of claim 12, wherein the at least one hardware processor is further configured to: in response to determining whether the client system matches the profile of the target device, if the client system matches the profile of the target device, determine whether the client system is eligible to perform forensic data collection according to a count of distinct client systems that have sent DNS query messages to the server computer system during a selected time interval; and in response, send a DNS response message including the service activation flag only when the client system is authorized to perform forensic data collection. 16. The server computer system of claim 12, wherein the at least one hardware processor is further configured to: in response to determining whether the client system matches the profile of the target device, if the client system matches the profile of the target device, search the client profile database to determine whether the selected software application is installed to run on the client system; and in response, send a DNS response message including the service activation flag only when the selected software application is set to run on the client system. 17. The server computer system of claim 12, wherein the at least one hardware processor is further configured to: in response to determining whether the client system matches the profile of the target device, if the client system matches the profile of the target device, randomly select a client system to collect forensic data; and in response, send a DNS response message including the service activation flag only when the client system is selected for forensic data collection. 18. The server computer system of claim 12, wherein the target device profile is representative of electronic devices further characterized by being devices of the selected device type. 19. The server computer system of claim 12, wherein the at least one hardware processor is further configured to identify the client system in accordance with a client ID included in the DNS query message, wherein the client ID uniquely identifies the client system among the plurality of client systems. 20. The server computer system of claim 19, wherein the client ID contains a hash value.

Images