Routing based request correlation

• US 10,180,993 B2
• Filed: 10/19/2017
• Issued: 01/15/2019
• Est. Priority Date: 05/13/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Raftery, James Brendan
• Primary Examiner(s): Jean, Frantz B
• Application Number:
  US15/788,657
• Publication Number:
  US 20180063027A1
• Time in Patent Office: 453 Days
• Field of Search: 709203
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Aspects of the disclosure will be described with regard to the processing of DNS queries by a DNS service based on multiple network addresses associated with a single network entity (e.g., a service provider). The DNS service may respond to each DNS query for identifying network addresses associated with the service provider with a respective unique network address from a pool of network addresses. Based on the uniqueness of network addresses, DNS queries and subsequent communications between respective client computing devices and the service can be correlated.

Claims

1. A computer-implemented method comprising:

under control of one or more computing devices configured with specific computer executable instructions,

associating a set of two or more distinct network addresses with a network-based service provider;

receiving a first query including an identifier of the network-based service provider, wherein the first query is received from a system other than a client computing device from which the first query originates;

selecting a first unique network address from the set of two or more distinct network addresses based, at least in part, on the first query, wherein the first unique network address is included in a first response to a second query previous to the first query;

transmitting a second response to the first query, wherein the second response includes the first unique network address and occurs after the first response;

receiving a request for network resources directed to the first unique network address;

correlating the first query with the request for network resources based, at least in part, on the first unique network address; and

causing service performance analysis based, at least in part, on the correlation to determine routing or processing improvements.

2. The method of claim 1, wherein the set of distinct network addresses includes at least one of IPv6 or IPv4 addresses.

3. The method of claim 1, wherein the system is a domain name system (DNS) resolver, and wherein the first query is received from the DNS resolver associated with the client computing device from which the first query originates.

4. The method of claim 1, wherein selecting the first unique network address further comprises:

determining a time that has lapsed since the first response; and

determining a measure of uniqueness of the selected network address based, at least in part, on the lapsed time.

5. The method of claim 4, wherein determining the measure of uniqueness is further based on a size of the set of the distinct network addresses.

6. The method of claim 1 further comprising:

receiving a third query including the identifier of the service provider;

selecting a second unique network address from the set of distinct network addresses based, at least in part, on the third query; and

transmitting a third response to the third query, wherein the third response includes the second unique network address.

7. The method of claim 6, wherein the second unique network address differs from the first unique network address.

8. The method of claim 7, wherein the third query is received within a wait time period since the receipt of the first query.

9. The method of claim 6, wherein the first unique network address and the second unique network address correspond to a same network address, and wherein the third query is received after a wait time period since the receipt of the first query.

10. A non-transitory computer readable storage medium storing computer executable instructions that when executed by at least one processor perform operations comprising:

obtaining a query including an identifier associated with a service provider, wherein the query is obtained from a system other than a client computing device from which the query originates;

selecting a distinct network address from a set of two or more network addresses associated with the service provider based, at least in part, on the query, wherein the distinct network address is included in a first response to a second query previous to the query;

causing transmission of the distinct network address in response to the query and after transmission of the first response, wherein the client computing device communicates with the service provider based on the distinct network address;

causing correlation between the query and the client computing device'"'"'s communication with the service provider based, at least in part, on the distinct network address; and

determining routing or processing improvements.

11. The non-transitory computer readable storage medium of claim 10, wherein the identifier associated with the service provider includes a uniform resource locator (URL).

12. The non-transitory computer readable storage medium of claim 10, wherein selecting the distinct network address is based, at least in part, on a confidence measure for the correlation.

13. The non-transitory computer readable storage medium of claim 12, wherein the confidence measure is determined based, at least in part, on a size of the set of network addresses.

14. The non-transitory computer readable storage medium of claim 10, wherein the operations further comprise adjusting the size of the set of network addresses based on incoming traffic of queries.

15. A system comprising:

a data store configured to store at least one computer-executable instruction; and

at least one processor in communication with the data store that, when executing the at least one computer-executable instruction, cause the system to;

obtain a first query including an identifier associated with a service provider, wherein the first query is obtained from an entity other than a first client computing device from which the first query originates;

select a first distinct network address from a set of two or more network addresses associated with the service provider based, at least in part, on the first query, wherein the first distinct network address is included in a first response to a second query previous to the first query;

cause transmission of the first distinct network address in response to the first query and after transmission of the first response, wherein the first client computing device communicates with the service provider based on the first distinct network address;

cause correlation between the first query and the first client computing device'"'"'s communication with the service provider based, at least in part, on the first distinct network address; and

determine routing or processing improvements.

16. The system of claim 15, wherein the processor is further configured to:

obtain a third query including the identifier of the service provider;

select a second distinct network address from the set of two or more network addresses associated with the service provider based, at least in part, on the third query; and

cause transmission of the second distinct network address in response to the third query, wherein a second client computing device communicates with the service provider based on the second distinct network address.

17. The system of claim 16, wherein the first query precedes the third query by a predetermined period of time, and wherein the first and second distinct network addresses correspond to a same network address.

18. The system of claim 17, wherein the predetermined period of time is determined based on statistics of communications between client computing devices and the service provider.

19. The system of claim 16, wherein the first distinct network address differs from the second distinct network address, and wherein the first and second client computing devices correspond to a same device.

20. The system of claim 16, wherein the system is a domain name system (DNS) resolver, and wherein the first query is obtained from the DNS resolver associated with the first client computing device from which the first query originates.