CHARACTERIZING UNREGISTERED DOMAIN NAMES

• US 20120331121A1
• Filed: 06/27/2012
• Published: 12/27/2012
• Est. Priority Date: 06/22/2009
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Colosi, John
• Granted Patent: US 9,148,334 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 61/302 Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Methods and apparatus for characterizing unregistered domain names are provided. One embodiment includes obtaining a list of a plurality of resolution requests for the unregistered domain names, determining a number of occurrences of each of the unregistered domain names, computing a plurality of groupings based on the number of occurrences, and associating a score with each of the unregistered domain names.

Claims

1-20. -20. (canceled)

21. A computer-implemented method, the method comprising:

receiving a plurality of resolution requests for domain names, each resolution request including at least one unregistered domain name;

forming a list of the plurality of resolution requests for the plurality of unregistered domain names;

receiving a request for the number of occurrences in the list for a particular unregistered domain name;

providing the number of occurrences in the list for the particular unregistered domain name.

22. The method of claim 21, wherein

the list includes the plurality of unregistered domain names;

and

the list separately counts domain names that share only a top-level domain and a second-level domain.

23. The method of claim 21, further comprising:

determining that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

24. The method of claim 21, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

25. The method of claim 24, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

26. The method of claim 24, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.

27. The method of claim 21, wherein the method is performed by at least one of a root DNS server or a DNS server.

28. A computer-implemented apparatus comprising:

at least one processor;

a memory containing instructions for execution by the at least one processor, such that the instructions cause the processor to;

receive a plurality of resolution requests for domain names, each resolution request including at least one unregistered domain name;

form a list of the plurality of resolution requests for the plurality of unregistered domain names;

receive a request for the number of occurrences in the list for a particular unregistered domain name;

provide the number of occurrences in the list for the particular unregistered domain name.

29. The apparatus of claim 28, wherein

the list includes the plurality of unregistered domain names;

and

the list separately counts domain names that share only a top-level domain and a second-level domain.

30. The apparatus of claim 28, wherein the instructions further cause the processor to:

determine that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

31. The apparatus of claim 28, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

32. The apparatus of claim 31, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

33. The apparatus of claim 31, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.

34. The apparatus of claim 28, wherein the apparatus is at least one of a root DNS server or a DNS server.

35. A non-transitory computer-readable medium including computer program code, the medium comprising:

code for receiving a plurality of resolution requests for domain names, each resolution request including at least one unregistered domain name;

code for forming a list of the plurality of resolution requests for the plurality of unregistered domain names;

code for receiving a request for the number of occurrences in the list for a particular unregistered domain name;

code for providing the number of occurrences in the list for the particular unregistered domain name.

36. The medium of claim 35, wherein

the list includes the plurality of unregistered domain names;

and

the list separately counts domain names that share only a top-level domain and a second-level domain.

37. The medium of claim 35, wherein the medium further comprises:

code for determining that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

38. The medium of claim 35, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

39. The medium of claim 38, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

40. The medium of claim 38, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.