Identify assets of interest in enterprise using popularity as measure of importance

• US 20200137024A1
• Filed: 10/31/2018
• Published: 04/30/2020
• Est. Priority Date: 10/31/2018
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Janakiraman, Ramsundar
• Granted Patent: US 11,025,588 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 61/5053 Lease time; Renewal aspects
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system may retrieve a packet in a network edge of a computer network. The system may identify a source address of the packet and a domain name that is being resolved that is associated with the packet and determining a time to live for the domain name, based at least in part on a record associated with the domain name. The server may further determine a relevance value indicative of an importance of a server associated with the domain name based at least in part on a frequency of the domain name in a domain name system list comprising a plurality of servers associated with a plurality of domain names, wherein the frequency is normalized by the time to live for the domain name. The system may sort the domain name system list according to the relevance value.

Claims

1. A computer-implemented method, comprising:

retrieving a packet in a network edge of a computer network;

identifying a source address of the packet and a domain name that is being resolved that is associated with the packet;

determining a time to live (TTL) for the domain name based at least in part on a record associated with the domain name;

determining a relevance value indicative of an importance of a server associated with the domain name based at least in part on a frequency of the domain name in a domain name system list comprising a plurality of servers associated with a plurality of domain names, wherein the frequency is normalized by the TTL for the domain name; and

sorting the domain name system list according to the relevance value.

2. The computer-implemented method of claim 1, wherein retrieving the packet in the network edge of the computer network comprises retrieving the packet at a tap point located between an access point in a local area network in the computer network and a domain name system server outside a firewall of a host in the computer network.

3. The computer-implemented method of claim 1, further comprising adding an entry in the domain name system list, wherein the entry includes the domain name, a network address associated with the domain name, and an attribute of the domain name.

4. The computer-implemented method of claim 1, wherein determining the TTL of the domain name comprises determining a maximum TTL from a plurality of record entries associated with the domain name.

5. The computer-implemented method of claim 1, wherein determining the TTL for the domain name comprises transmitting a request to a Start of Authority (SOA) record for a plurality of timer values of a domain name to network address binding associated with the domain name, and selecting a last entry in the SOA record as the TTL.

6. The computer-implemented method of claim 1, wherein determining the TTL for the domain name comprises associating a domain name entry in a SOA record with a timer value indicative of how often the domain name entry is associated with a network address in a network transaction.

7. The computer-implemented method of claim 1, wherein determining the TTL for the domain name comprises assigning a lower value of the TTL for the domain name if the packet originated from a content delivery network, compared to if the packet originated in a proxy server.

8. The computer-implemented method of claim 1, wherein determining the TTL for the domain name comprises selecting a shortest TTL value from a group consisting of one or more canonical names associated to the domain name for the source address.

9. The computer-implemented method of claim 1, further comprising caching network traffic originated in the source address for at least the TTL for the domain name.

10. The computer-implemented method of claim 1, further comprising querying a server at the source address for a packet status at least once during a period of time equal to the TTL for the domain name.

11. A system, comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to cause the system to;

retrieve a packet in a network edge of a computer network;

identify a source address of the packet and a domain name that is being resolved that is associated with the packet;

determine a time to live (TTL) for the domain name, based at least in part on a record associated with the domain name;

determine a relevance value indicative of an importance of a server associated with the source address based at least in part on a frequency of a domain name in the domain name system list associated with the packet, wherein the frequency is normalized by the TTL for the domain name; and

sort the domain name system list according to the relevance value.

12. The system of claim 11, wherein to retrieve the packet in a network edge of the computer network the one or more processors are configured to retrieve the packet at a tap point located between an access point in a local area network in the computer network and a domain name system server outside a firewall of a host in the computer network.

13. The system of claim 11, wherein the one or more processors are further configured to add an entry in the domain name system list, wherein the entry includes the domain name, a network address associated with the domain name, and an attribute of the domain name.

14. The system of claim 11, wherein to determine the TTL of the domain name the one or more processors are configured to determine a maximum TTL from a plurality of record entries associated with the domain name.

15. The system of claim 11, wherein to determine the TTL for the domain name the one or more processors are configured to transmit a request to a Start of Authority (SOA) record for a plurality of timer values of a domain name to network address binding associated with the domain name, and selecting a last entry in the SOA record as the TTL.

16. The system of claim 11, wherein to determine the TTL for the domain name the one or more processors are configured to associate a domain name entry in a SOA record with a timer value indicative of how often the domain name entry is associated with a network address in a network transaction.

17. A non-transitory, computer readable medium storing instructions which, when executed by a processor, cause a computer to perform a method, the method comprising:

retrieving a packet in a network edge of a computer network;

identifying a source address of the packet and a domain name that is being resolved that is associated with the packet;

determining a time to live (TTL) for the domain name, based at least in part on a record associated with the domain name;

determining a relevance value indicative of an importance of a server associated with the source address based at least in part on a frequency of the domain name in a domain name system list comprising a plurality of servers associated with a plurality of domain names, wherein the frequency is normalized by the TTL for the domain name; and

sorting the domain name system list according to the relevance value.

18. The non-transitory, computer readable medium of claim 17, wherein retrieving the packet in the network edge of the computer network comprises retrieving the packet at a tap point located between an access point in a local area network in the computer network and a domain name system server outside a firewall of a host in the computer network.

19. The non-transitory, computer readable medium of claim 17, wherein the method further comprises adding an entry in the domain name system list, wherein the entry includes the domain name, a network address associated with the domain name, and an attribute of the domain name.

20. The non-transitory, computer readable medium of claim 17, wherein, in the method, determining the TTL of the domain name comprises determining a maximum TTL from a plurality of record entries associated with the domain name.