The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Dec. 23, 2025

Filed:

Apr. 28, 2023
Applicant:

Palo Alto Networks, Inc., Santa Clara, CA (US);

Inventors:

Janos Szurdi, Sunnyvale, CA (US);

Daiping Liu, Sunnyvale, CA (US);

Tong Zhao, San Jose, CA (US);

Tingxiang Zhu, Sunnyvale, CA (US);

Linan Li, Mountain View, CA (US);

Assignee:

Palo Alto Networks, Inc., Santa Clara, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
H04L 9/40 (2022.01); H04L 41/16 (2022.01); H04L 67/1014 (2022.01); H04L 67/14 (2022.01);
U.S. Cl.
CPC ...
H04L 63/20 (2013.01); H04L 41/16 (2013.01); H04L 63/0236 (2013.01); H04L 63/0272 (2013.01); H04L 63/1416 (2013.01); H04L 67/1014 (2013.01); H04L 67/14 (2013.01);
Abstract

A service includes a trained model comprising a classifier that predicts whether domain names are dictionary DGA generated. Using passive DNS data and/or a heuristic analysis based on natural language processing of the domain name, the service filters domain names that are not candidate (i.e., potential) dictionary DGA domain names out of the detection pipeline. There domain names are thus classified without being fed into the model for more computationally expensive processing. Domain names that are not filtered out are queued for input into an instance of the model and classification by the model, with the queued domain names processed in small batches and load balanced across model instances. Predicted domain name classes output by the model are cached for subsequent cache reads to avoid multiple runs of the model for one domain name.


Find Patent Forward Citations

Loading…