Acalvio Technologies, Inc.

Nominum, Inc.

Erik Wu

Peter Wisowaty

Edward Brown

Provided are methods, network devices, and computer-program products for a domain name system (DNS) threat detection engine for analyzing DNS traffic for potential threats. In various implementations, the DNS threat detection engine can include threat profiles that include characteristics of network threats associated with DNS. When a DNS message includes a characteristic associated with a particular threat profile, a remediation rule associated with the threat profile can be used to modify the DNS message, including modifying the destination for the DNS message. When the DNS message is received at the new destination, the DNS message can be analyzed to determine whether the DNS message is associated with a threat to the network.

Enterprise DNS analysis

A method predicting a network activity associated with a given network site is provided. The method can include receiving a request to predict a probability of network activity associated with the network site, analyzing historical data associated with the network site, and, based on the analysis, determining the probability of the network activity in future. The method can further include monitoring the network site, ascertaining evidence associated with the network activity, and, based on the evidence, adjusting treatment of the network site. Additionally, the method can include comparing the probability to a predetermined threshold probability and, based on the comparison, selectively taking an action concerning the network site.

Growing community of inventors

Marietta, GA, United States of America

Erik Wu