Traffic Like NXDomains

• US 20120254398A1
• Filed: 03/31/2011
• Published: 10/04/2012
• Est. Priority Date: 03/31/2011
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Thomas, Matthew
• Granted Patent: US 8,504,673 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Methods and systems for analyzing network traffic related to domain names, including Non-Existent Domain names, comprise: storing network traffic data associated with DNS requests for NXDs; receiving an analysis request associated with a domain name; creating, based on the stored network traffic data, an NXD list comprising NXDs that received at least one DNS request during a specified time period; computing, based on the stored network traffic data, a similarity metric for each NXD listed in the NXD list; and providing an analysis report identifying potentially valuable NXDs based on the computed similarity metrics.

Claims

1. A computer-implemented method of analyzing network traffic related to domain names, comprising:

storing network traffic data associated with DNS requests for NXDs;

receiving an analysis request associated with at least one identified domain name;

creating, based on the stored network traffic data, an NXD list comprising NXDs that received at least one DNS request during a time period;

computing, based on the stored network traffic data, a similarity metric for each NXD listed in the NXD list; and

providing an analysis report identifying potentially valuable NXDs based on the computed similarity metrics.

2. The method of claim 1, further comprising:

observing network traffic data associated with DNS requests;

identifying the type of domain associated with the DNS requests;

partitioning the stored network traffic data according to the identified type of domain associated with the DNS request.

3. The method of claim 1, wherein the stored network traffic data is partitioned by at least one of the last name server making the DNS request or the time the DNS request was made.

4. The method of claim 1, further comprising:

sorting NXDs listed in the analysis report based on the computed similarity metrics; and

removing NXDs listed in the analysis report associated with similarity metrics below a threshold value.

5. The method of claim 1, wherein the traffic data comprises at least the IP addresses of the last name servers making the DNS requests and the times each DNS request occurred.

6. The method of claim 1, wherein a root name server for a top-level domain stores the network traffic data.

7. The method of claim 1, wherein the time period includes a time period that the at least one identified domain name was an NXD.

8. The method of claim 1, further comprising:

filtering the stored network traffic data to remove network traffic data associated with machine-generated activity;

9. The method of claim 1, further comprising:

comparing the computed similarity metric for each NXD to a metric associated with the DNS traffic of the at least one identified domain name when the at least one identified domain name was an NXD;

selecting a subset of the NXD list based on the comparison; and

wherein the analysis report comprises the selected subset and the computed similarity metrics associated with NXDs of the selected subset.

10. The method of claim 1, further comprising:

prioritizing the list of NXDs based on the similarity metrics.

11. The method of claim 1, wherein the similarity metrics are computed in response to the analysis request and represent the similarity of each NXD relative to the at least one identified domain name.

12. The method of claim 1, wherein the similarity metrics are pre-computed as hash values depicting a DNS traffic signature of each NXD.

13. A computer system for analyzing network traffic related to domain names, comprising:

a processing system comprising one or more processors; and

a memory system comprising one or more computer-readable media, wherein the computer readable media store instructions that, when executed by the processing system, cause the system to perform the operations of;

storing network traffic data associated with DNS requests for NXDs;

receiving an analysis request associated with at least one identified domain name;

creating, based on the stored network traffic data, an NXD list comprising NXDs that received at least one DNS request during a time period;

computing, based on the stored network traffic data, a similarity metric for each NXD listed in the NXD list; and

providing an analysis report identifying potentially valuable NXDs based on the computed similarity metrics.

14. The system of claim 13, wherein the computer-readable media further stores instructions for:

observing network traffic data associated with DNS requests;

identifying the type of domain associated with the DNS requests; and

partitioning the stored network traffic data according to the identified type of domain associated with the DNS request.

15. The system of claim 13, wherein the stored network traffic data is partitioned by at least one of the last name servers making the DNS request or the time the DNS request was made.

16. The system of claim 13, wherein the computer-readable media further stores instructions for:

sorting NXDs listed in the analysis report based on the computed similarity metrics; and

removing NXDs listed in the analysis report associated with similarity metrics below a threshold value.

17. The system of claim 13, wherein the traffic data comprises at least the IP addresses of the last name servers making the DNS requests and the times each DNS request occurred.

18. The system of claim 13, wherein a root name server for a top-level domain stores the network traffic data.

19. The system of claim 13, wherein the time period includes a time period that the at least one identified domain name was an NXD.

20. The system of claim 13, wherein the computer-readable media further stores instructions for:

filtering the stored traffic data to remove traffic data associated with machine-generated activity.

21. The system of claim 13, wherein the computer-readable media further stores instructions for:

comparing the computed similarity metric for each NXD to a metric associated with the DNS traffic of the at least one identified domain name when the at least one identified domain name was an NXD;

selecting a subset of the NXD list based on the comparison; and

wherein the analysis report comprises the selected subset and the computed similarity metrics associated with NXDs of the selected subset.

22. The system of claim 13, wherein the computer-readable media further stores instructions for:

prioritizing the list of NXDs based on the similarity metrics.

23. The system of claim 13, wherein the similarity metrics are computed in response to the analysis request and represent the similarity of each NXD relative to the received domain name.

24. The system of claim 13, wherein the similarity metrics are pre-computed as hash values depicting a DNS traffic signature of each NXD.