Existent domain name DNS traffic capture and analysis

• US 8,521,908 B2
• Filed: 10/30/2009
• Issued: 08/27/2013
• Est. Priority Date: 04/07/2009
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Holmes, Alexander D., Simpson, Andrew W., Shyamsunder, Karthik, Sunkara, Srinivas, Orentas, Leonard, Larson, Matt, Kosters, Mark, Kamara, Tamir, Lanxner, Eyal, Zohar, Nir, Mankin, Shevek
• Primary Examiner(s): DAILEY, THOMAS J
• Application Number:
  US12/609,831
• Publication Number:
  US 20100257266A1
• Time in Patent Office: 1,397 Days
• Field of Search: 709/217, 709/245
• US Class Current: 709/245
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: G06Q 30/0273 Determination of fees for advertising
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: G06Q 30/0282 Rating or review of business operators or products
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Systems and methods for scoring a domain web traffic based on DNS traffic requests received at an authoritative name server to resolve the domain name. A request to resolve the domain name is received at an authoritative name server. A counter, such as a server counter or a hit counter, for the domain name is incremented based on the received request. A score, such as a domain traffic score or a domain rank, is calculated based upon a count of the counter. Calculating the score may also include applying a weighting factor to the counters based on information about a requesting set of resolvers and other domains/websites that may be linking and driving traffic to the domain whose traffic score is being calculated. Examples of relevant set of resolvers information may include location, traffic levels, traffic type and architecture of the set of resolvers.

Claims

1. An automated method for scoring a domain, comprising:

receiving at an authoritative name server a request to resolve a domain name;

incrementing a server counter for the domain name;

creating a weighting factor for a requesting set of resolvers, the weighting factor including a value;

determining whether the request is likely related to user generated traffic;

if the request id likely related to user generated traffic, increasing the value of the weighting factor; and

calculating a domain traffic score based upon the server counter,

wherein calculating the domain traffic score includes applying the weighting factor to the server counter.

2. The method of claim 1, wherein the server counter is limited to one count for a particular requesting set of resolvers in a predetermined period of time.

3. The method of claim 2, further comprising incrementing a hit counter each time the authoritative name server receives a request to resolve the domain name,

wherein, calculating the domain traffic score is further based upon the hit counter.

4. The method of claim 1, wherein the weighting factor is based on a geographical location of the requesting set of resolvers.

5. The method of claim 1, wherein the weighting factor is based on at least one of a network traffic level and a network traffic type of the requesting set of resolvers.

6. The method of claim 1, wherein the weighting factor is based on an architecture of the requesting set of resolvers.

7. The method of claim 1, further comprising:

automatically calculating domain traffic scores for a plurality of domains serviced by the authoritative name server;

automatically ranking the plurality of domains based on the domain traffic scores; and

determining an advertising rate for at least one of the domains based on the rank of the at least one domain.

8. The method of claim 1, wherein requests that include a “

www”

string are counted separately from requests that do not include a “

www”

string.

9. The method of claim 8, wherein a count of the requests including the “

www”

string are weighted differently in the calculation than a count of the requests not including the “

www”

string.

10. A system for scoring a domain, comprising:

a processor;

a memory programmed with computer-executable code that causes the processor to perform a method comprising;

receiving at an authoritative name server a request to resolve a domain name;

incrementing a server counter for the domain name;

creating a weighting factor for a requesting set of resolvers, the weighting factor including a value;

determining whether the request is likely related to user generated traffic;

if the request is likely related to user generated traffic, increasing the value of the weighting factor; and

calculating a domain traffic score based upon the server counter,

wherein calculating the domain traffic score includes applying the weighting factor to the server counter.

11. The system of claim 10, wherein the server counter is limited to one count for a particular requesting set of resolvers in a predetermined period of time.

12. The system of claim 11, further comprising incrementing a hit counter each time the authoritative name server receives a request to resolve the domain name,

wherein, calculating the domain traffic score is further based upon the hit counter.

13. The system of claim 10, wherein the weighting factor is based on a geographical

location of the requesting set of resolvers.

14. The system of claim 10, wherein the weighting factor is based on at least one of a network traffic level and a network traffic type of the requesting set of resolvers.

15. The system of claim 10, wherein the weighting factor is based on architecture of the requesting set of resolvers.

16. The system of claim 10, further comprising:

automatically calculating domain traffic scores for a plurality of domains serviced by the authoritative name server;

automatically ranking the plurality of domains based on the domain traffic scores; and

determining an advertising rate for at least one of the domains based on the rank of the at least one domain.

17. The system of claim 10, wherein requests that include a “

www”

string are counted

separately from requests that do not include a “

www”

string.

18. The system of claim 17, wherein a count of the requests including the “

www”

string are weighted differently in the calculation than a count of the requests not including the “

www”

string.