Domain name and internet address approved and disapproved membership interface

• US 10,389,680 B2
• Filed: 10/30/2013
• Issued: 08/20/2019
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Manadhata, Pratyusa Kumar, Gokhale, Amruta
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US15/021,015
• Publication Number:
  US 20160226819A1
• Time in Patent Office: 2,120 Days
• Field of Search: 709220
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

According to an example, domain name and IP address approved and disapproved membership inference may include receiving domain names and IP addresses, and mapping the domain names to the IP addresses. Domain names that belong to an approved domain name list or to a disapproved domain name list may be identified. IP addresses that belong to an approved IP address list or to a disapproved IP address list may be identified. For an unknown IP address and domain names that map to the unknown IP address, a determination is made as to whether more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list. Based on the determination, the unknown IP address may be designated as approved and assigned to the approved IP address list, or alternatively, designated as disapproved and assigned to the disapproved IP address list.

Claims

1. A method for domain name and Internet Protocol (IP) address approved and disapproved membership inference, the method comprising:

receiving a plurality of domain names and a plurality of IP addresses;

determining a mapping of the received plurality of domain names to the received plurality of IP addresses;

identifying domain names from the received plurality of domain names that belong to an approved domain name list or to a disapproved domain name list;

identifying IP addresses from the received plurality of IP addresses that belong to an approved IP address list or to a disapproved IP address list;

for an unknown IP address from the received plurality of IP addresses and domain names that map to the unknown IP address, determining, by at least one processor, if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list;

in response to a determination that more than the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designating the unknown IP address as approved and assigning the unknown IP address to the approved IP address list; and

in response to a determination that less than or equal to the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designating the unknown IP address as disapproved and assigning the unknown IP address to the disapproved IP address list.

2. The method of claim 1, further comprising:

for an unknown domain name from the received plurality of domain names and IP addresses that map to the unknown domain name, determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list;

in response to a determination that more than the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designating the unknown domain name as approved and assigning the unknown domain name to the approved domain name list; and

in response to a determination that less than or equal to the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designating the unknown domain name as disapproved and assigning the unknown domain name to the disapproved domain name list.

3. The method of claim 1, further comprising:

assigning a confidence interval to the designation of the unknown IP address as approved or disapproved;

determining if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designating the unknown IP address as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designating the unknown IP address as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list.

4. The method of claim 2, further comprising:

assigning a confidence interval to the designation of the unknown domain name as approved or disapproved;

determining if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designating the unknown domain name as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designating the unknown domain name as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list.

5. The method of claim 1, wherein determining if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list further comprises:

computing an adjusted fraction related to the domain names that map to the unknown IP address by;

accounting for a total number of the received plurality of domain names, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

comparing the computed adjusted fraction to a threshold to determine whether the unknown IP address is designated as approved or as disapproved.

6. The method of claim 2, wherein determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list further comprises:

computing an adjusted fraction related to the IP addresses that map to the unknown domain name by;

accounting for a total number of the received plurality of IP addresses, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

comparing the computed adjusted fraction to a threshold to determine whether the unknown domain name is designated as approved or as disapproved.

7. The method of claim 1, further comprising:

marking a time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses;

determining if the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds a predetermined time interval based on a current time;

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds the predetermined time interval based on the current time, updating the mapping of the received plurality of domain names to the received plurality of IP addresses; and

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses is less than or equal to the predetermined time interval based on the current time, waiting for the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses to exceed the predetermined time interval before updating the mapping of the received plurality of domain names to the received plurality of IP addresses.

8. A non-transitory machine-readable storage medium comprising instructions that when executed by a processing resource cause a computing device to:

receive a plurality of domain names and a plurality of IP addresses;

determine a mapping of the received plurality of domain names to the received plurality of IP addresses;

identify domain names from the received plurality of domain names that belong to an approved domain name list or to a disapproved domain name list;

identify IP addresses from the received plurality of IP addresses that belong to an approved IP address list or to a disapproved IP address list;

for an unknown IP address from the received plurality of IP addresses and domain names that map to the unknown IP address, determine, by at least one processor, if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list;

in response to a determination that more than the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designate the unknown IP address as approved and assigning the unknown IP address to the approved IP address list; and

in response to a determination that less than or equal to the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designate the unknown IP address as disapproved and assigning the unknown IP address to the disapproved IP address list.

9. The non-transitory machine-readable storage medium of claim 8, wherein the instructions further cause the computing device to:

for an unknown domain name from the received plurality of domain names and IP addresses that map to the unknown domain name, determine if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list;

in response to a determination that more than the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designate the unknown domain name as approved and assigning the unknown domain name to the approved domain name list; and

in response to a determination that less than or equal to the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designate the unknown domain name as disapproved and assigning the unknown domain name to the disapproved domain name list.

10. The non-transitory machine-readable storage medium of claim 8, wherein the instructions further cause the computing device to:

assign a confidence interval to the designation of the unknown IP address as approved or disapproved;

determine if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designate the unknown IP address as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designate the unknown IP address as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list.

11. The non-transitory machine-readable storage medium of claim 9, wherein the instructions further cause the computing device to:

assign a confidence interval to the designation of the unknown domain name as approved or disapproved;

determine if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designate the unknown domain name as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designate the unknown domain name as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list.

12. The non-transitory machine-readable storage medium of claim 8, wherein the instructions further cause the computing device, when determining if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list further, to:

compute an adjusted fraction related to the domain names that map to the unknown IP address by;

account for a total number of the received plurality of domain names, and

account for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

compare the computed adjusted fraction to a threshold to determine whether the unknown IP address is designated as approved or as disapproved.

13. The non-transitory machine-readable storage medium of claim 8, wherein the instructions further cause the computing device, when determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, to:

compute an adjusted fraction related to the IP addresses that map to the unknown domain name by;

accounting for a total number of the received plurality of IP addresses, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

compare the computed adjusted fraction to a threshold to determine whether the unknown domain name is designated as approved or as disapproved.

14. The non-transitory machine-readable storage medium of claim 8, wherein the instructions further cause the computing device to:

mark a time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses;

determine if the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds a predetermined time interval based on a current time;

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds the predetermined time interval based on the current time, update the mapping of the received plurality of domain names to the received plurality of IP addresses; and

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses is less than or equal to the predetermined time interval based on the current time, wait for the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses to exceed the predetermined time interval before updating the mapping of the received plurality of domain names to the received plurality of IP addresses.