Routing based request correlation

• US 9,832,141 B1
• Filed: 05/13/2015
• Issued: 11/28/2017
• Est. Priority Date: 05/13/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Raftery, James Brendan
• Primary Examiner(s): Jean, Frantz
• Application Number:
  US14/711,502
• Time in Patent Office: 930 Days
• Field of Search: 709203, 709226
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Aspects of the disclosure will be described with regard to the processing of DNS queries by a DNS service based on multiple network addresses associated with a single network entity (e.g., a service provider). The DNS service may respond to each DNS query for identifying network addresses associated with the service provider with a respective unique network address from a pool of network addresses. Based on the uniqueness of network addresses, DNS queries and subsequent communications between respective client computing devices and the service can be correlated.

Claims

1. A computer-implemented method for managing domain name system (DNS) queries, the computer-implemented method comprising:

under control of one or more computing devices configured with specific computer executable instructions,

associating a set of two or more distinct network addresses with a network-based service provider;

receiving a first DNS query including an identifier of the network-based service provider, wherein the first DNS query originated from a first client computing device;

selecting a first unique network address from the set of two or more distinct network addresses based, at least in part, on the first DNS query;

transmitting a first response to the first DNS query, wherein the first response includes the first unique network address;

receiving, from an entity different than an entity that transmitted the first DNS query, a request for network resources directed to the first unique network address;

correlating the first DNS query with the request for network resources based, at least in part, on the first unique network address such that the first DNS query and the request for network resources are associated; and

causing service performance analysis based, at least in part, on the correlation to determine routing or processing improvements.

2. The method of claim 1, wherein the set of distinct network addresses includes at least one of IPv6 or IPv4 addresses.

3. The method of claim 1, wherein the first DNS query is received from a DNS resolver associated with the first client computing device.

4. The method of claim 1, wherein selecting the first unique network address comprises selecting a network address included in a previous response to a previous DNS query, wherein the previous response occurs prior to the first response.

5. The method of claim 4, wherein selecting the first unique network address further comprises:

determining a time that has lapsed since the previous response; and

determining a measure of uniqueness of the selected network address based, at least in part, on the lapsed time.

6. The method of claim 5, wherein determining the measure of uniqueness is further based on a size of the set of the distinct network addresses.

7. The method of claim 1 further comprising:

receiving a second DNS query including the identifier of the service provider;

selecting a second unique network address from the set of distinct network addresses based, at least in part, on the second DNS query; and

transmitting a second response to the second DNS query, wherein the second response includes the second unique network address.

8. The method of claim 7, wherein the second unique network address differs from the first unique network address.

9. The method of claim 8, wherein the second DNS query is received within a wait time period since the receipt of the first DNS query.

10. The method of claim 7, wherein the first unique network address and the second unique network address correspond to a same network address and wherein the second DNS query is received after a wait time period since the receipt of the first DNS query.

11. A non-transitory computer readable storage medium storing computer executable instructions that when executed by at least one processor perform operations comprising:

obtaining a domain name system (DNS) query including an identifier associated with a service provider, wherein the DNS query originated from a client computing device and is obtained from an entity different than the client computing device;

selecting a distinct network address from a set of two or more network addresses associated with the service provider based, at least in part, on the DNS query;

causing transmission of the distinct network address in response to the DNS query, wherein the client computing device communicates with the service provider based on the distinct network address;

causing correlation between the DNS query and the client computing device'"'"'s communication with the service provider based, at least in part, on the distinct network address such that the DNS query and the client computing device'"'"'s communication are associated; and

determining routing or processing improvements.

12. The non-transitory computer readable storage medium of claim 11, wherein the identifier associated with the service provider includes a uniform resource locator (URL).

13. The non-transitory computer readable storage medium of claim 11, wherein selecting the distinct network address is based, at least in part, on a confidence measure for the correlation.

14. The non-transitory computer readable storage medium of claim 13, wherein the confidence measure is determined based, at least in part, on a size of the set of network addresses.

15. The non-transitory computer readable storage medium of claim 11, wherein the operations further comprise adjusting the size of the set of network addresses based on incoming traffic of DNS queries.

16. A system comprising:

at least one data store configured to at least store computer-executable instructions; and

at least one processor in communication with the data store that, when executing the computer-executable instructions, cause the system to;

obtain a first domain name system (DNS) query including an identifier associated with a service provider, wherein the first DNS query originated from a first client computing device and is obtained from an entity different than the first client computing device;

select a first distinct network address from a set of two or more network addresses associated with the service provider based, at least in part, on the first DNS query;

cause transmission of the first distinct network address in response to the first DNS query, wherein the first client computing device communicates with the service provider based on the first distinct network address;

cause correlation between the first DNS query and the first client computing device'"'"'s communication with the service provider based, at least in part, on the first distinct network address such that the first DNS query and the first client computing device'"'"'s communication are associated; and

determine routing or processing improvements.

17. The system of claim 16, wherein the processor is further configured to:

obtain a second DNS query including the identifier of the service provider;

select a second distinct network address from the set of two or more network addresses associated with the service provider based, at least in part, on the second DNS query; and

cause transmission of the second distinct network address in response to the second DNS query, wherein a second client computing device communicates with the service provider based on the second distinct network address.

18. The system of claim 17, wherein the first DNS query precedes the second DNS query by a predetermined period of time, and wherein the first and second distinct network addresses correspond to a same network address.

19. The system of claim 18, wherein the predetermined period of time is determined based on statistics of communications between client computing devices and the service provider.

20. The system of claim 17, wherein the first distinct network address differs from the second distinct network address, and wherein the first and second client computing devices correspond to a same device.