Characterizing unregistered domain names

• US 9,148,334 B2
• Filed: 06/27/2012
• Issued: 09/29/2015
• Est. Priority Date: 06/22/2009
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Colosi, John
• Primary Examiner(s): Yohannes, Tesfay
• Application Number:
  US13/534,513
• Publication Number:
  US 20120331121A1
• Time in Patent Office: 1,189 Days
• Field of Search: 709/219, 709/216, 709/223, 370/310, 370/503
• US Class Current: 1/1
• CPC Class Codes: H04L 61/302 Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Methods and apparatus for characterizing unregistered domain names are provided. One embodiment includes obtaining a list of a plurality of resolution requests for the unregistered domain names, determining a number of occurrences of each of the unregistered domain names, computing a plurality of groupings based on the number of occurrences, and associating a score with each of the unregistered domain names.

Claims

1. A computer-implemented method, the method comprising:

receiving a plurality of resolution requests for domain names, each resolution request of the plurality of resolution requests including at least one unregistered domain name, wherein the at least one unregistered domain name is not registered with a domain name system registry;

forming a list of the plurality of resolution requests for the plurality of unregistered domain names, wherein the list separately lists unregistered domain names that share only a top-level domain and a second-level domain;

receiving a request for a number of occurrences in the list for a particular unregistered domain name;

providing the number of occurrences in the list for the particular unregistered domain name; and

determining a score for the particular unregistered domain name based on the number of occurrences.

2. The method of claim 1, further comprising:

determining, in each of the plurality of resolution requests, that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

3. The method of claim 1, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

4. The method of claim 3, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

5. The method of claim 3, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.

6. The method of claim 1, wherein the method is performed by at least one of a root DNS server or a DNS server.

18. The method of claim 1, further comprising determining a value for the particular unregistered domain name based at least in part on the number of occurrences in the list for the particular unregistered domain name.

21. The method of claim 1, wherein the plurality of resolution requests for domain names are received from a plurality of domain name system servers.

7. A computer-implemented apparatus comprising:

at least one processor;

a memory containing instructions for execution by the at least one processor, such that the instructions cause the processor to;

receive a plurality of resolution requests for domain names, each resolution request of the plurality of resolution requests including at least one unregistered domain name, wherein the at least one unregistered domain name is not registered with a domain name system registry;

form a list of the plurality of resolution requests for the plurality of unregistered domain names, wherein the list separately lists unregistered domain names that share only a top-level domain and a second-level domain;

receive a request for a number of occurrences in the list for a particular unregistered domain name;

provide the number of occurrences in the list for the particular unregistered domain name; and

determine a score for the particular unregistered domain name based on the number of occurrences.

8. The apparatus of claim 7, wherein the instructions further cause the processor to:

determine, in each of the plurality of resolution requests, that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

9. The apparatus of claim 7, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

10. The apparatus of claim 9, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

11. The apparatus of claim 9, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.

12. The apparatus of claim 7, wherein the apparatus is at least one of a root DNS server or a DNS server.

19. The apparatus of claim 7, wherein the instructions further cause the processor to determine a value for the particular unregistered domain name based at least in part on the number of occurrences in the list for the particular unregistered domain name.

22. The apparatus of claim 7, wherein the plurality of resolution requests for domain names are received from a plurality of domain name system servers.

13. A non-transitory computer-readable medium comprising instructions that cause one or more processors to perform a method comprising:

receiving a plurality of resolution requests for domain names, each resolution request of the plurality of resolution requests including at least one unregistered domain name, wherein the at least one unregistered domain name is not registered with a domain name system registry;

forming a list of the plurality of resolution requests for the plurality of unregistered domain names, wherein the list separately lists unregistered domain names that share only a top-level domain and a second-level domain;

receiving a request for a number of occurrences in the list for a particular unregistered domain name;

providing the number of occurrences in the list for the particular unregistered domain name; and

determining a score for the particular unregistered domain name based on the number of occurrences.

14. The medium of claim 13, wherein the instructions that cause the one or more processors further perform the method comprising:

determining, in each of the plurality of resolution requests, that the at least one unregistered domain name is unregistered when a root DNS server sends an NX record.

15. The medium of claim 13, wherein the list further includes a timestamp field, a requesting-machine identifier field, and an unregistered domain name field.

16. The medium of claim 15, wherein for each resolution request, the timestamp field includes one of a time of generation of the resolution request or a time of creation of an NX record.

17. The medium of claim 15, wherein the list further includes at least one of source and destination Media Access Control addresses, source and destination ports, sequence identifiers, or flags.

20. The medium of claim 13, wherein the instructions that cause the one or more processors further perform the method comprising determining a value for the particular unregistered domain name based at least in part on the number of occurrences in the list for the particular unregistered domain name.

23. The medium of claim 13, wherein the plurality of resolution requests for domain names are received from a plurality of domain name system servers.