Nominum, Inc.

Akamai Technologies, Inc.

James Paugh

Robert S Wilbourn

Paul O'Leary

Thanh Nguyen

Iurii Iuzifovich

Mikael Kullberg

Hongliang Liu

Ali Fakeri-Tabrizi

Erik D Fears

Yuriy Yuzifovich

Provided is a method for domain name ranking. An example method includes receiving Domain Name System (DNS) data, which includes domain names. The DNS data is processed to obtain multiple metric values for each of the domain names. The metric values can include a query count (QC), a client count (CC), and a network count (NC). The method proceeds with calculating a score for each of the domain names based on the metric values. The calculation can be performed using the following equation: Score=NC&#xb7;CC&#xb7;(1+log(QC)). Furthermore, the method ranks the domain names based on the score for each of the domain names. The ranking can be based on normalization of the scores or based on converting the scores into respective percentile ranks.

DNS-based ranking of domain names

The present disclosure is related to a computer-implemented method and system for distinguishing human-driven Doman Name System (DNS) queries from Machine-to-Machine (M2M) DNS queries. The method includes receiving a DNS query, which includes a domain name, generating a probability score for the domain name based on one or more predetermined rules, and categorizing the DNS query as a human-driven DNS query or a M2M DNS query based on the probability score.

Distinguishing human-driven DNS queries from machine-to-machine DNS queries

The disclosure is related to computer-implemented methods for domain name scoring. In one example, the method includes receiving a request to provide a reputation score of a domain name, receiving input data associated with the domain name, extracting a plurality of features from the input data and the domain name, generating a feature vector based on the plurality of features, and calculating the reputation score of the domain name by a machine-learning classifier based on a graph database, which includes feature vectors associated with at least a plurality of reference domain names, a plurality of servers, a plurality of domain name owners, and so forth. In another example, the method can calculate the reputation score by finding a similarity between the feature vector and one of domain name clusters in the graph database. The reputation score represents a probability that the domain name is associated with malicious activity.

System for domain reputation scoring

A computer-implemented method for detecting anomalies in DNS requests comprises receiving a plurality of DNS requests generated within a predetermined period. The predetermined period includes a plurality of DNS data fragments. The method further includes receiving a first DNS request and selecting a plurality of second DNS requests from the plurality of DNS requests such that each of the second DNS requests is a subset of the first DNS request. The method also includes calculating a count value for each of the DNS data fragments, where each of the count values represents a number of instances the second DNS requests appear within one of the DNS data fragments. In some embodiments, the count values for each of the DNS data fragments can be normalized. The method further includes determining an anomaly trend, for example, based on determining that at least one of the count values exceeds a predetermined threshold value.

Analyzing DNS requests for anomaly detection

The present disclosure is related to a computer-implemented method and system for distinguishing human-driven Domain Name System (DNS) queries from Machine-to-Machine (M2M) DNS queries. The method includes receiving a DNS query, which includes a domain name, generating a probability score for the domain name based on one or more predetermined rules, and categorizing the DNS query as a human-driven DNS query or a M2M DNS query based on the probability score.

Growing community of inventors

San Carlos, CA, United States of America

James Paugh