Infoblox Inc.

Les Smith

Bin Yu

Mark Threefoot

Techniques for an exponential moving maximum (EMM) filter for predictive analytics in network reporting are disclosed. In some embodiments, a process for predictive analytics in network reporting using an EMM filter includes pre-processing network-related data by performing exponential moving maximum (EMM) filtering on the network-related data; and determining predictive analytics based on the EMM filtered network-related data.

Exponential moving maximum (EMM) filter for predictive analytics in network reporting

Flux domain is generally an active threat vector, and flux domain behaviors are continually changing in an attempt to evade existing detection measures. Accordingly, new and improved techniques are disclosed for flux domain detection. In some embodiments, an online platform implementing an analytics framework for DNS security is provided for facilitating flux domain detection. For example, the online platform can implement an analytics framework for DNS security based on passive DNS traffic analysis, disclosed herein with respect to various embodiments.

Platforms for implementing an analytics framework for DNS security

New and improved techniques for a behavior analysis based DNS tunneling detection and classification framework for network security are disclosed. In some embodiments, a platform implementing an analytics framework for DNS security is provided for facilitating DNS tunneling detection. For example, an online platform can implement an analytics framework for DNS security based on passive DNS traffic analysis.

Behavior analysis based DNS tunneling detection and classification framework for network security

Techniques for a hardware accelerator for a domain name server (DNS) cache are disclosed. In some embodiments, a hardware accelerator for a DNS cache includes: executing a packet processing engine of a host device to identify a DNS request; and performing a DNS lookup in the DNS cache. In some embodiments, a hardware accelerator for a DNS cache includes: determining if a time to live (TTL) parameter associated with a first entry stored in the DNS cache is below a threshold value; and if the TTL parameter associated with the first entry stored in the DNS cache is below the threshold value, then performing a pre-fetch operation to update the first entry in the DNS cache, wherein the updated entry comprises an updated TTL value.

Growing community of inventors

Pleasanton, CA, United States of America

Les Smith