Evaluation of DNS pre-registration data to predict future DNS traffic

• US 9,049,229 B2
• Filed: 06/29/2011
• Issued: 06/02/2015
• Est. Priority Date: 10/28/2010
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Thomas, Matthew
• Primary Examiner(s): MIAH, RAZU A
• Application Number:
  US13/171,584
• Publication Number:
  US 20120110165A1
• Time in Patent Office: 1,434 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: G06Q 30/0273 Determination of fees for advertising
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Methods and systems analyze historical NXD traffic to predict future DNS traffic. In one embodiment, a system may count NXD responses generated by an Authoritative DNS server during a particular time period and calculate the variance in NXD traffic for domains over time. The system may then generate a coefficient of variance (CoV) value for each domain observed. Finally, the system may predict positive domain traffic based upon the calculated CoV data. In other embodiments, the system may also base the prediction on the classification of domains as “original” domains or “re-registered” domains. In another embodiment, the system may also base the prediction on the “size” of name servers. Additionally, or alternatively, the system may determine the number of unique name servers for a domain and base the prediction on the number of unique name servers for a particular domain name.

Claims

1. A method for predicting future network traffic, comprising:

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

based on at least the calculated variance and received NXD requests, predicting at least one of expected name-in-use response levels for the one or more candidate domains, expected click traffic for the one or more candidate domains, or a combination thereof; and

providing an indication of the expected name-in-use response levels, expected click traffic, or a combination thereof to a purchaser, wherein the indication comprises at least one of relative monetization values for the one or more candidate domains, value ratings for the one or more candidate domains according to a predetermined baseline, or predicted traffic statistics for the one or more candidate domains.

2. The method of claim 1, wherein the calculated variance is expressed as a Coefficient of Variance (CoV) value.

3. The method of claim 2, further comprising:

filtering the one or more candidate domains to remove domains with a CoV value below a predetermined threshold level; and

making the predictions only for the remaining one or more candidate domains.

4. The method of claim 1, wherein the predictions are made relative to one or more other domains.

5. A method for predicting future network traffic, comprising:

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for each of the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

determining the size of each of the plurality of name servers, the size of a name server being proportional to the total number of NXD requests sent by the name server;

identifying the one or more candidate domains as an Original Domain or as a Reregistered domain; and

based on the received NXD requests and at least one of the calculated variance, the identification of the one or more candidate domains as Original or Registered, the determined sizes of the plurality of name servers, or a combination thereof, predicting at least one of the expected name-in-use (YXD) response levels for the one or more candidate domains, the expected click traffic for the one or more candidate domains relative to at least one other domain, or a combination thereof.

6. The method of claim 5, further comprising:

providing an indication of the expected name-in-use response levels, expected click traffic, or a combination thereof to a purchaser.

7. The method of claim 6, wherein the indication comprises at least one of relative monetization values for the one or more candidate domains, value ratings for the one or more candidate domains according to a predetermined baseline, or predicted traffic statistics for the one or more candidate domains.

8. The method of 5, further comprising:

determining whether the received NXD requests for Re-registered domains are associated with machine-generated internet activity;

filtering the received NXD requests to remove NXD requests associated with machine-generated internet activity for Re-registered domains; and

making the prediction based on at least the identification and filtered NXD requests.

9. A computer-implemented method, performed by a computer system comprising one or more processors and computer memory, for predicting future network traffic, comprising:

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

based on at least the calculated variance and received NXD requests, predicting at least one of expected name-in-use response levels for the one or more candidate domains, expected click traffic for the one or more candidate domains, or a combination thereof; and

providing an indication of the expected name-in-use response levels, expected click traffic, or a combination thereof to a purchaser, wherein the indication comprises at least one of relative monetization values for the one or more candidate domains, value ratings for the one or more candidate domains according to a predetermined baseline, or predicted traffic statistics for the one or more candidate domains.

10. The computer-implemented method of claim 9, wherein the calculated variance is expressed as a Coefficient of Variance (CoV) value.

11. The computer-implemented method of claim 10, further comprising:

filtering the one or more candidate domains to remove domains with a CoV value below a predetermined threshold level; and

making the predictions only for the remaining one or more candidate domains.

12. The computer-implemented method of claim 9, wherein the predictions are made relative to one or more other domains.

13. A system comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, perform a method for predicting future network traffic, comprising;

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

based on at least the calculated variance and received NXD requests, predicting at least one of expected name-in-use response levels for the one or more candidate domains, expected click traffic for the one or more candidate domains, or a combination thereof; and

providing an indication of the expected name-in-use response levels, expected click traffic, or a combination thereof to a purchaser, wherein the indication comprises at least one of relative monetization values for the one or more candidate domains, value ratings for the one or more candidate domains according to a predetermined baseline, or predicted traffic statistics for the one or more candidate domains.

14. The system of claim 13, wherein the calculated variance is expressed as a Coefficient of Variance (CoV) value.

15. The system of claim 14, wherein the one or more processors further perform the method comprising:

filtering the one or more candidate domains to remove domains with a CoV value below a predetermined threshold level; and

making the predictions only for the remaining one or more candidate domains.

16. The system of claim 13, wherein the predictions are made relative to one or more other domains.

17. A non-transitory computer-readable storage medium containing instructions which, when executed on a processor, perform a method for predicting future network traffic, comprising:

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels; and

based on at least the calculated variance and received NXD requests, predicting at least one of expected name-in-use response levels for the one or more candidate domains, expected click traffic for the one or more candidate domains, or a combination thereof; and

providing an indication of the expected name-in-use response levels, expected click traffic, or a combination thereof to a purchaser, wherein the indication comprises at least one of relative monetization values for the one or more candidate domains, value ratings for the one or more candidate domains according to a predetermined baseline, or predicted traffic statistics for the one or more candidate domains.

18. A system comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, perform a method for predicting future network traffic, comprising;

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for each of the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

determining the size of each of the plurality of name servers, the size of a name server being proportional to the total number of NXD requests sent by the name server;

identifying the one or more candidate domains as an Original Domain or as a Reregistered domain; and

based on the received NXD requests and at least one of the calculated variance, the identification of the one or more candidate domains as Original or Registered, the determined sizes of the plurality of name servers, or a combination thereof, predicting at least one of the expected name-in-use (YXD) response levels for the one or more candidate domains, the expected click traffic for the one or more candidate domains relative to at least one other domain, or a combination thereof.

19. A non-transitory computer-readable storage medium containing instructions which, when executed on a processor, perform a method for predicting future network traffic, comprising:

receiving non-existent domain (NXD) requests from a plurality of name servers for one or more candidate domains over a first period of time;

calculating a variance in the NXD responses for each of the one or more candidate domains over time, wherein a higher variance indicates lower expected traffic levels;

determining the size of each of the plurality of name servers, the size of a name server being proportional to the total number of NXD requests sent by the name server;

identifying the one or more candidate domains as an Original Domain or as a Reregistered domain; and

based on the received NXD requests and at least one of the calculated variance, the identification of the one or more candidate domains as Original or Registered, the determined sizes of the plurality of name servers, or a combination thereof, predicting at least one of the expected name-in-use (YXD) response levels for the one or more candidate domains, the expected click traffic for the one or more candidate domains relative to at least one other domain, or a combination thereof.