Verisign, Inc.

Abedelaziz Mohaisen

G Craig Murray

Eric Osterweil

Danny McPherson

Trevor Tonn

Allison Mankin

Maliheh Shirvanian

Yannis Labrou

Hesham Mekky

Md Mansurul Alam Bhuiyan

Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Methods and systems for domain name data networking

The disclosure is directed to providing content access control in information centric networking (ICN) networks. Methods and systems include hardware and/or software that perform operations for sending to a content provider of an ICN network an access request for content in response to receiving a first content request from a client. The operations also include receiving from the content provider access control information for the content. The operations further include sending to the client a challenge. Additionally, the operations include receiving from the client an authorization of the content provider that includes information obtained by the client from the content provider based on the challenge. Furthermore, the operations include verifying the authorization received from the client using the access control information received from the content provider. Moreover, the operations include sending to the client the content.

Access control for named domain networking

Embodiments relate to systems, devices, and computer-implemented methods for characterizing domain names by determining a name server switching footprint for domain names using a data set corresponding to name server operations for the domain names. The domain names can be clustered into groups based on the name server switching footprints, and intended uses of domain names in a group can be extrapolated to other domain names in the group. Name server switching footprints can also be predicted for new domains names using a prediction model trained using the determined name server switching footprints for the domain names in the data set.

Characterization of domain names based on changes of authoritative name servers

Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.

Systems, devices, and methods for separating malware and background events

The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Classifying malware by order of network behavior artifacts

Embodiments relate to systems, devices, and computer-implemented methods for preventing determination of previous access of sensitive content by receiving, from a user, a request for content at a device in an information centric network, where a cached version of the content is locally stored at the device; initiating a time delay based on a determination that the user has not previously requested the content; and transmitting the cached version of the content to the user after the time delay.

Growing community of inventors

Williamsville, NY, United States of America

Abedelaziz Mohaisen