Verisign, Inc.

Tomofumi Okubo

Eric Osterweil

Matthew Thomas

Yannis Labrou

Danny McPherson

Arunabho Das

Ashkan Nikravesh

Gautam Gudavalli

Jeshmi Raman

Terry Bernstein

A method for detecting a predetermined behavior during a domain name registration or a domain resolution activity includes identifying one or more dimensions to be tracked. One or more metrics for each dimension is/are identified. A first time series for each of the metrics is generated. One or more first outliers in at least one of the first time series is detected. One or more sets of metrics is generated, each set including a combination of two or more of the metrics. A second time series for each of the metrics in the one or more sets of metrics is generated. One or more second outliers in at least one of the second time series is/are detected.

Detection of aberrant domain registration and resolution patterns

A method for detecting a domain name that is associated with malicious behavior includes receiving domain data for a plurality of domain names including a first domain name and a plurality of similar domain names. The domain data includes a first attribute and a second attribute of the first domain name and the similar domain names. The first attribute of the first domain name is compared to the first attributes of the similar domain names to produce a first value. The second attribute of the first domain name is compared to the second attributes of the similar domain names to produce a second value. The first value and the second value are combined to produce a combined value. A likelihood that the first domain name is associated with malicious behavior is determined based on the combined value.

Systems, devices, and methods for detecting and mitigating domain name registrations used for malicious behavior

In one embodiment, a DNS service provider determines that a domain name being configured by a user is a lame delegated domain name and manages the configuration of the domain name accordingly. In operation, when a user of the DNS service provider attempts to provide configuration information for a domain name, the DNS service provider determines whether the domain name is lame delegated to the DNS service provider. If the domain name is lame delegated, then, to avoid passing control of the domain name to a nefarious entity, the DNS service provider performs a verification process to determine whether the user is the rightful owner of the domain name. The user is allowed to configure the domain name within the DNS service provider when the user is the rightful owner of the domain name.

Managing lame delegated domains within a managed DNS service

Systems and methods for detecting spoofed traffic include determining a first hop count of a first data query from a first transmitting device to a first server, determining a second hop count of a second data query from the first transmitting device to a second server, determining a third hop count of a third data query appearing to be from the first transmitting device to the first server, and determining a fourth hop count of a fourth data query appearing to be from the first transmitting device to the second server. The third and fourth hop counts are compared to the first and second hop counts, respectively. It is determined whether the third hop count differs from the first hop count by more than a predetermined amount.

Growing community of inventors

Herndon, VA, United States of America

Tomofumi Okubo