DNS wildcard beaconing

摘要

DNS wildcard beaconing. In one embodiment, for example, a computer-implemented method comprises: receiving a network request from a resolver to resolve a hostname, the network request from the resolver comprising a network address of the resolver, the hostname comprising a unique wildcard portion; storing first data representing an association between at least the unique wildcard portion and the network address of the resolver; receiving a network request from a client for a resource, the network request from the client comprising a network address of the client and at least the unique wildcard portion; storing second data representing an association between at least the unique wildcard portion and the network address of the client; based on the first data and the second data, associating the client with the resolver; and storing third data representing the association between the client and the resolver.

主权项

1. A method comprising:
receiving a network request from a resolver to resolve a hostname, the network request from the resolver comprising a network address of the resolver, the hostname comprising a unique wildcard portion that makes the hostname unresolvable by the resolver; in response to receiving the network request from the resolver to resolve a hostname, wherein the network address from the resolver comprises the network address of the resolver, storing first information representing an association between at least the unique wildcard portion of the hostname that makes the hostname unresolvable by the resolver and the network address of the resolver; receiving a network request from a client for a resource, the network request from the client for a resource comprising a network address of the client and at least the unique wildcard portion of the hostname that makes the hostname unresolvable by the resolver; storing second information representing an association between at least the unique wildcard portion of the hostname that makes the hostname unresolvable by the resolver and the network address of the client; associating the client with the resolver based on the first information representing an association between at least the unique wildcard portion of the hostname that makes the hostname unresolvable by the resolver and the network address of the resolver and the second information representing an association between at least the unique wildcard portion of the hostname that makes the hostname unresolvable by the resolver and the network address of the client; and storing third information representing the association between the client and the resolver; using the third information to route subsequent requests to resolve hostnames to resolvers; and wherein the method is performed by one or more computing devices.