Distinguishing human-driven DNS queries from machine-to-machine DNS queries

• US 10,164,989 B2
• Filed: 12/15/2015
• Issued: 12/25/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Nominum Incorporated (Akamai Technologies, Inc.)
• Inventors: Paugh, James, O'Leary, Paul, Wilbourn, Robert S., Nguyen, Thanh, Iuzifovich, Iurii, Fears, Erik D.
• Primary Examiner(s): Gilles, Jude Jean
• Application Number:
  US14/969,947
• Publication Number:
  US 20160099961A1
• Time in Patent Office: 1,106 Days
• Field of Search: 709203, 709206, 709225, 709208
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/26 Special purpose or proprietary protocols or architectures network applications for proprietary or special purpose networking environments H04L67/12

Abstract

The present disclosure is related to a computer-implemented method and system for distinguishing human-driven Domain Name System (DNS) queries from Machine-to-Machine (M2M) DNS queries. The method includes receiving a DNS query, which includes a domain name, generating a probability score for the domain name based on one or more predetermined rules, and categorizing the DNS query as a human-driven DNS query or a M2M DNS query based on the probability score.

Claims

1. A non-transitory processor-readable medium having instructions stored thereon, which when executed by one or more processors, cause the one or more processors to implement a method, comprising:

receiving a DNS query, wherein the DNS query includes a domain name;

generating a probability score for the domain name based on one or more predetermined rules; and

based on the probability score, categorizing the DNS query as a human-driven DNS query or a M2M DNS query.

2. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include comparing the domain name to records of a DNS query dictionary;

wherein the DNS query dictionary includes a first list of trusted domain names associated with various human-driven DNS queries and a second list of trusted domain names associated with various M2M DNS queries.

3. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include determining that the domain name is associated with a front-end domain name and not with a backend domain name;

and based on the determination that the domain name is associated with the front-end domain name, generating or updating the probability score of the DNS query to indicate a higher probability that the DNS query is a human-driven DNS query and not a M2M DNS query.

4. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include determining that the DNS query has a “

www”

prefix; and

based on the determination that the DNS query has the “

www”

prefix, generating or updating the probability score of the DNS query to indicate a higher probability that the DNS query is a human-driven DNS query and not a M2M DNS query.

5. The non-transitory processor-readable medium of claim 4, further comprising determining that the DNS query having the “

www”

prefix does not fall into one or more predetermined exceptions; and

based on the determination that the DNS query having the “

www”

prefix relates to the one or more predetermined exceptions, generating or updating the probability score of the DNS query to indicate a higher probability that the DNS query is a M2M DNS query and not a human-driven DNS query.

6. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include determining that the DNS query is addressed to a Content Delivery Network (CDN);

and based on the determination that the DNS query is addressed to the CDN, generating or updating the probability score of the DNS query to indicate a higher probability that the DNS query is a M2M DNS query and not a human-driven DNS query.

7. The non-transitory processor-readable medium of claim 6, wherein determining that the DNS query is addressed to the CDN includes determining that DNS query includes a “

cdn”

string.

8. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include determining that the DNS query is associated with a predetermined time pattern;

and based on the determination that the DNS query is associated with a predetermined time pattern, generating or updating the probability score of the DNS query to indicate a higher probability that the DNS query is a M2M DNS query and not a human-driven DNS query.

9. The non-transitory processor-readable medium of claim 8, wherein the determining that the DNS query is associated with the predetermined time pattern includes determining that there is a plurality of historical DNS queries, which are substantially the same as the DNS query, and that the plurality of historical DNS queries and the DNS query are periodically generated within a predetermined period and according to the predetermined time pattern.

10. The non-transitory processor-readable medium of claim 1, wherein the one or more predetermined rules include ranking the domain name associated with the DNS query.

11. The non-transitory processor-readable medium of claim 10, wherein the ranking of the domain name includes receiving a first rank of the domain name.

12. The non-transitory processor-readable medium of claim 10, wherein the ranking of the domain name includes calculating a second rank of the domain name, wherein the calculating of the second rank of the domain name includes:

based on the DNS query, obtaining multiple metric values of the domain name, wherein the metric values include a query count (QC), a client count (CC), and a network count (NC); and

based on the multiple metric values, generating the second rank of the domain name.

13. The non-transitory processor-readable medium of claim 12, wherein the generating of the second rank includes applying the following equation to the metric values:

Rank=NC·

CC·

(1+log(QC)).

14. The non-transitory processor-readable medium of claim 1, further comprising:

assigning the probability score to the DNS query;

storing the DNS query with an associated probability score in a DNS query dictionary; and

updating the DNS query dictionary with a plurality of additional DNS queries with associated probability scores, wherein the plurality of additional DNS queries are associated with a plurality of human-driven DNS queries and a plurality of M2M DNS queries.

15. The non-transitory processor-readable medium of claim 14, further comprising:

training a machine-learning classifier based on the DNS query dictionary;

wherein the generating of the probability score for the domain name based on the one or more predetermined rules includes applying the machine-learning classifier to the DNS query;

wherein the machine-learning classifier is configured to, when applied to a first DNS query generated by a user during web browsing activity, generate a first probability score indicating that the first DNS query is a human-driven DNS query, and wherein the machine-learning classifier is configured to, when applied to a second DNS query not generated by a user during a web browsing activity, generate a second probability score indicating that the second DNS query is a M2M DNS query.

16. The non-transitory processor-readable medium of claim 15, further comprising determining that the DNS query is associated with a malicious activity.

17. The non-transitory processor-readable medium of claim 16, further comprising excluding the DNS query associated with a malicious activity from the DNS query dictionary.

18. The non-transitory processor-readable medium of claim 16, wherein the determining that the DNS query is associated with the malicious activity includes:

obtaining historical DNS data associated with the same DNS query;

calculating a QC for the DNS query;

determining that the QC is higher than a predetermined threshold value;

determining that the domain name of the DNS query does not have a predetermined rank; and

associating the DNS query with a malicious activity.

19. A computer-implemented system for processing DNS queries, the system comprising at least one processor and at least one memory storing processor-executable codes, wherein the at least one processor is configured to:

receive a DNS query, wherein the DNS query includes a domain name;

generate a probability score for the domain name based on one or more predetermined rules;

based on the probability score, categorize the DNS query as a human-driven DNS query or a M2M DNS query.