Verisign, Inc.

Allscripts Software, LLC

Matthew Thomas

Eric Osterweil

Jasenko Ibrahimbegovic

Tomofumi Okubo

Danny McPherson

Vincenzo Russo

Yannis Labrou

William Loftus

Harry Wepuri

Arif Ogan

Qi Alfred Chen

Nipun Jawalkar

Benoit Perroud

Ashkan Nikravesh

Gautam Gudavalli

Michael Noll

Sylvain Luiset

A method for detecting a predetermined behavior during a domain name registration or a domain resolution activity includes identifying one or more dimensions to be tracked. One or more metrics for each dimension is/are identified. A first time series for each of the metrics is generated. One or more first outliers in at least one of the first time series is detected. One or more sets of metrics is generated, each set including a combination of two or more of the metrics. A second time series for each of the metrics in the one or more sets of metrics is generated. One or more second outliers in at least one of the second time series is/are detected.

Detection of aberrant domain registration and resolution patterns

A method includes converting a user's utterance to text; encapsulating the converted text in a rheme object; searching, for each of a plurality of topics, for keywords in the converted text; determining a relevancy metric for each of the plurality of topics based on such searching; selecting one or more topics based on determined relevancy metrics; comparing some or all of the converted text to names in one or more patient lists or databases; identifying a unique patient whose name is contained in the converted; attaching an indication of the identified patient to the rheme object; effecting an action based on the selected one or more topics and the attached patient indication; and saving the topic in a conversation history with a reference to the identified patient.

Conversational agent

A method for detecting a domain name that is associated with malicious behavior includes receiving domain data for a plurality of domain names including a first domain name and a plurality of similar domain names. The domain data includes a first attribute and a second attribute of the first domain name and the similar domain names. The first attribute of the first domain name is compared to the first attributes of the similar domain names to produce a first value. The second attribute of the first domain name is compared to the second attributes of the similar domain names to produce a second value. The first value and the second value are combined to produce a combined value. A likelihood that the first domain name is associated with malicious behavior is determined based on the combined value.

Systems, devices, and methods for detecting and mitigating domain name registrations used for malicious behavior

Some embodiments provide a technique for detecting highly-vulnerable domain names and remediating associated problems. The technique can include collecting DNS data representing a requests to the DNS over a period of time and determining a subset of the DNS data representing DNS-based service discovery requests to unregistered domains over the period of time. The technique can also include, for each of the unregistered domains, determining a query ratio and a persistence ratio. The technique can also include ranking the unregistered domains according to a metric that includes the query ratios and the persistence ratios, such that a ranked list of domain names is produced and outputting an initial segment of the ranked list of domain names as the highly-vulnerable domain names. The technique can also include remediating attacks on at least one of the highly-vulnerable domain names.

Detecting and remediating highly vulnerable domain names using passive DNS measurements

Systems and methods for detecting spoofed traffic include determining a first hop count of a first data query from a first transmitting device to a first server, determining a second hop count of a second data query from the first transmitting device to a second server, determining a third hop count of a third data query appearing to be from the first transmitting device to the first server, and determining a fourth hop count of a fourth data query appearing to be from the first transmitting device to the second server. The third and fourth hop counts are compared to the first and second hop counts, respectively. It is determined whether the third hop count differs from the first hop count by more than a predetermined amount.

Anycast-based spoofed traffic detection and mitigation

Methods and systems analyze historical NXD traffic to predict future DNS traffic. In one embodiment, a system may count NXD responses generated by an Authoritative DNS server during a particular time period and calculate the variance in NXD traffic for domains over time. The system may then generate a coefficient of variance (CoV) value for each domain observed. Finally, the system may predict positive domain traffic based upon the calculated CoV data. In other embodiments, the system may also base the prediction on the classification of domains as 'original' domains or 're-registered' domains. In another embodiment, the system may also base the prediction on the &#x201c;size&#x201d; of name servers. Additionally, or alternatively, the system may determine the number of unique name servers for a domain and base the prediction on the number of unique name servers for a particular domain name.

Evaluation of DNS pre-registration data to predict future DNS traffic

Methods and systems are disclosed for assessing an identifier. The method comprises receiving a string of characters making up the identifier and determining a keyboard type for a keyboard. The method further comprises calculating, by a calculator module, a typeability score for the identifier based on the string of characters and the keyboard type, wherein the typeability score signifies a difficulty of typing the identifier on the keyboard type. In certain embodiments, the method further comprises determining a finger positioning corresponding to a position of a typer's fingers on the keyboard, and the typeability score is further based on the finger positioning. In some embodiments, the finger positioning is based on the typer's typing habits.

Evaluating typeability of domain names

Techniques for inferring the existence of suspicious software by detecting multiple name server requests for the same sets of non-existent domains. Implementations can allow for detecting the existence of malware or other suspicious software without requiring reverse engineering of the malware's domain generation algorithm.

Detecting co-occurrence patterns in DNS

Methods and systems for detecting aberrant behavior in time-series observation data, such as non-existent domain data, are disclosed. The methods and systems analyze the time-series observation data to determine time-series prediction data. The time-series observation data and time-series prediction data are used to determine a threshold that is based on the standard deviation of deviation values between the time-series observation data and time-series prediction data. The threshold may be used to detect aberrant behavior in subsequently obtained time-series observation data.

Methods and systems for statistical aberrant behavior detection of time-series data

Methods and systems for generating and authenticating barcodes and in particular generating secure barcodes are disclosed. In one embodiment, a method, performed by a certificate authority for creating a trusted content, comprises receiving, via a receiver, a target content and verifying the target content to determine whether the target content is safe or appropriate. Further, the method comprises, based on a result of the verifying, generating and storing, in a storage medium, response data; generating, via a processor, and storing in the storage medium an identifier corresponding to the response data; generating, via the processor, resolution data, the resolution data including the identifier and an address of the certificate authority; and transmitting, via a transmitter, the resolution data as the trusted content.

Secure barcodes

Methods and systems are disclosed for assessing an identifier. The method comprises receiving, via an interface, a string of characters making up the identifier and determining a keyboard type for a keyboard. The method further comprises calculating, by a calculator module, a typeability score for the identifier based on the string of characters and the keyboard type, wherein the typeability score signifies a difficulty of typing the identifier on the determined keyboard type. In certain embodiments, the method further comprises determining a finger positioning corresponding to a position of a typer's fingers on the keyboard, and the typeability score is further based on the finger positioning. In some embodiments, the finger positioning is based on the typer's typing habits.

Methods and systems provide tracking or logging requests to resolve non-existent textual identifiers and classifying the textual identifier into a predefined set of taxonomical categories to support the detection of machine generated textual identifiers. Detection includes calculating a measure of probability based on the analysis and classification of prior textual identifier requests from a set of requests for a specific textual identifier.

Method of and apparatus for identifying machine-generated textual identifiers

Methods and systems provide tracking or logging requests to resolve non-existent textual identifiers and classifying the textual identifier into a predefined set of taxonomical categories to support the detection of requestors of machine generated requests to resolve textual identifiers. Detection includes calculating a measure of probability based on the analysis and classification of prior textual identifier requests from a requestor.

Method of and apparatus for identifying requestors of machine-generated requests to resolve a textual identifier

Methods and systems provide tracking or logging requests to resolve non-existent domain (NXDomains) and organizing the NXDomains to support searching of the domain names including ranking the NXDomains based on popularity, e.g, number of hits or potential traffic based on the number of requests made for the NXDomain. NXDomain logs may be organized so that it supports searching by creating an inverted index including n-grams of the NXDomains. Searching includes identifying a target substring in one or more of the indexes, selecting those matching NXDomains satisfying some threshold criteria, and displaying the NXDomains in a selected order such as by demand or popularity associated with, for example, a selected geographical location from which resolution requests targeting respective NXDomains originate.

Growing community of inventors

Atlanta, GA, United States of America

Matthew Thomas