# US 10,375,017 B2 · Detecting and mitigating registrar collusion in drop-add acquisitions of domain names > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,017 B2 - Document ID: US10375017B2 - Status: Granted - Kind: B2 - Application number: 14/985,569 - Filed: 2015-12-31 - Published: 2017-07-06 - Granted: 2019-08-06 - Earliest claimed: 2015-12-31 - Assignees: VeriSign, Inc. - Applicants: Verisign, Inc. - Inventors: Arash Molavi Kakhki; Andrew West; Nipun Jawalkar; Vincenzo Russo - Web page: https://patentgrep.com/patent/US10375017B2 ## CPC - H04L 61/3005: {Mechanisms for avoiding name conflicts} - H04L 61/302: {Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]} - H04L 61/3025: {Domain name generation or assignment} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and method for detecting domain name system (DNS) registrar collusion include a collusion detector at a registry. The collusion detector obtains information related to name acquisition requests submitted by DNS registrars attempting to acquire domain names in a drop pool of expired domain names and provides attempt sets containing the domain names targeted by the DNS registrars for acquisition. Each attempt set contains at least one targeted domain name that a respective DNS registrar attempted to acquire via at least one name acquisition request. The collusion detector determines a degree of similarity between two or more attempt sets corresponding to a pair of the DNS registrars, estimates a likelihood of collusion between the pair of DNS registrars based on the degree of similarity, and performs any mitigation action warranted by the likelihood of collusion. ## Claims ### Claim 1 A system for detecting domain name system (DNS) registrar collusion, comprising: a collusion detector at a DNS registry; and a non-transitory memory storing instructions that, when executed by at least one processor of the collusion detector, cause the collusion detector to perform a method comprising: obtaining information related to a plurality of name acquisition requests, wherein a plurality of DNS registrars submit the plurality of name acquisition requests attempting to acquire one or more targeted domain names in a drop pool of expired domain names, wherein the drop pool of expired domain names comprises one or more domain names that are scheduled to be dropped from the DNS registry after a registration period of each of the one or more domain names has expired; providing, for the plurality of DNS registrars, a plurality of attempt sets containing the one or more targeted domain names, wherein the plurality of attempt sets each contains at least one targeted domain name that a respective DNS registrar of the plurality of DNS registrars attempted to acquire via at least one of the plurality of name acquisition requests; determining a similarity of overlap between two or more attempt sets of the plurality of attempt sets corresponding to a pair of DNS registrars of the plurality of DNS registrars; estimating a likelihood of collusion between the pair of DNS registrars based on the similarity; and performing mitigation actions in response to the likelihood of collusion. ### Claim 2 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform providing the plurality of attempt sets by: analyzing the plurality of attempt sets for highly targeted domain names, wherein the highly targeted domain names are targeted by at least a predetermined number of the plurality of DNS registrars; and filtering the two or more attempt sets to exclude the highly targeted domain names to provide two or more filtered attempt sets. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform determining the similarity by: determining an overlap between two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars. ### Claim 4 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform determining the similarity by: determining an overlap between two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars and a timeslot. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform determining the similarity by: performing a longitudinal analysis of two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars and a plurality of timeslots longitudinal across a period of time. ### Claim 6 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform determining the similarity by: generating a heat map indicating registrar overlap based on the two or more attempt sets corresponding to pairs of the plurality of DNS registrars, wherein x- and y-axes of the heat map each corresponds to the plurality of DNS registrars; and determining the similarity between the pairs of DNS registrars based on the heat map. ### Claim 7 (depends on 1) The system of claim 1, wherein the plurality of name acquisition requests include a plurality of Extensible Provisioning Protocol requests. ### Claim 8 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform: filtering the one or more targeted domain names to include only domain names that the plurality of DNS registrars attempted to acquire during one or more timeslots. ### Claim 9 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform: filtering the one or more targeted domain names to include only domain names that are in at least one top-level domain. ### Claim 10 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform: filtering the one or more targeted domain names to exclude domain names that are in at least one top-level domain. ### Claim 11 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform providing the plurality of attempt sets by: removing duplicate domain names in each attempt set of the plurality of attempt sets. ### Claim 12 (depends on 1) The system of claim 1, wherein the instructions cause the collusion detector to further perform: determining that the likelihood of collusion between the two or more DNS registrars satisfies a predetermined threshold; and blocking at least one name acquisition request from at least one of the two or more DNS registrars. ### Claim 13 A method for detecting domain name system (DNS) registrar collusion, the method comprising: obtaining information related to a plurality of name acquisition requests, wherein a plurality of DNS registrars submit the plurality of name acquisition requests attempting to acquire one or more targeted domain names in a drop pool of expired domain names, wherein the drop pool of expired domain names comprises one or more domain names that are scheduled to be dropped from the DNS registry after a registration period of each of the one or more domain names has expired; providing, for the plurality of DNS registrars, a plurality of attempt sets containing the one or more targeted domain names, wherein the plurality of attempt sets each contains at least one targeted domain name that a respective DNS registrar of the plurality of DNS registrars attempted to acquire via at least one of the plurality of name acquisition requests; determining a similarity of overlap between two or more attempt sets of the plurality of attempt sets corresponding to a pair of DNS registrars of the plurality of DNS registrars; estimating a likelihood of collusion between the pair of DNS registrars based on the similarity; and performing mitigation actions in response to the likelihood of collusion. ### Claim 14 (depends on 13) The method of claim 13, wherein providing the plurality of attempt sets further comprises: analyzing the plurality of attempt sets for highly targeted domain names, wherein the highly targeted domain names are targeted by at least a predetermined number of the plurality of DNS registrars; and filtering the two or more attempt sets to exclude the highly targeted domain names to provide two or more filtered attempt sets. ### Claim 15 (depends on 13) The method of claim 13, wherein determining the similarity further comprises: determining an overlap between two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars. ### Claim 16 (depends on 13) The method of claim 13, wherein determining the similarity further comprises: determining an overlap between two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars and a timeslot. ### Claim 17 (depends on 13) The method of claim 13, wherein determining the similarity further comprises: performing a longitudinal analysis of two or more attempt sets of the plurality of attempt sets corresponding to the pair of DNS registrars and a plurality of timeslots longitudinal across a period of time. ### Claim 18 (depends on 13) The method of claim 13, further comprising: filtering the one or more targeted domain names to include only domain names that the plurality of DNS registrars attempted to acquire during one or more timeslots. ### Claim 19 (depends on 13) The method of claim 13, further comprising: filtering the one or more targeted domain names to include only domain names that are in at least one top-level domain. ### Claim 20 A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor at a domain name system (DNS) registry, causes the at least one processor to execute a method for detecting DNS registrar collusion, the method comprising: obtaining information related to a plurality of name acquisition requests, wherein a plurality of DNS registrars submit the plurality of name acquisition requests attempting to acquire one or more targeted domain names in a drop pool of expired domain names, wherein the drop pool of expired domain names comprises one or more domain names that are scheduled to be dropped from the DNS registry after a registration period of each of the one or more domain names has expired; providing, for the plurality of DNS registrars, a plurality of attempt sets containing the one or more targeted domain names, wherein the plurality of attempt sets each contains at least one targeted domain name that a respective DNS registrar of the plurality of DNS registrars attempted to acquire via at least one of the plurality of name acquisition requests; determining a similarity of overlap between two or more attempt sets of the plurality of attempt sets corresponding to a pair of DNS registrars of the plurality of DNS registrars; estimating a likelihood of collusion between the pair of DNS registrars based on the similarity; and performing mitigation actions in response to the likelihood of collusion.