Performing rule-based actions for domain names accessed by particular parties
AssigneeSplunk Inc.
InventorMunawar Monzy Merza
Life of this patent
Estimating the term…
Abstract
Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.
Claims20
A method, comprising:
- extracting a set of accessed domain names from a set of events stored in a field-searchable data store;
- identifying a respective access party for at least some of the accessed domain names in the set of accessed domain names, wherein the respective access party is the party that accessed the accessed domain name;
- identifying a subset of accessed domain names in the set of accessed domain names accessed by one or more particular respective access parties and meet a first criterion, wherein the first criterion is based on a recency of registration of an accessed domain name in the set of accessed domain names, and wherein the recency of registration comprises an age from a first time when the accessed domain name was registered with a registrar to a current time;
- determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
- performing an action for each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion according to one or more rules associated with the accessed domain name;
- wherein the method is performed by one or more computing devices.
One or more non-transitory computer-readable media, storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:
- extracting a set of accessed domain names from a set of events stored in a field-searchable data store;
- identifying a respective access party for at least some of the accessed domain names in the set of accessed domain names, wherein the respective access party is the party that accessed the accessed domain name;
- identifying a subset of accessed domain names in the set of accessed domain names that have a respective access party that meets a first criterion, wherein the first criterion is based on a recency of registration of an accessed domain name in the set of accessed domain names, and wherein the recency of registration comprises an age from a first time when the accessed domain name was registered with a registrar to a current time;
- determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
- performing an action for each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion according to one or more rules associated with the accessed domain name.
An apparatus, comprising:
- an event extraction device, implemented at least partially by hardware, that extracts a set of accessed domain names from a set of events stored in a field-searchable data store;
- a domain name evaluation device, implemented at least partially by hardware, that identifies a respective access party for at least some of the accessed domain names in the set of accessed domain names, wherein the respective access party is the party that accessed the accessed domain name;
- wherein the domain name evaluation device identifies a subset of accessed domain names in the set of accessed domain names that have a respective access party that meets a first criterion, wherein the first criterion is based on a recency of registration of an accessed domain name in the set of accessed domain names, and wherein the recency of registration comprises an age from a first time when the accessed domain name was registered with a registrar to a current time;
- a domain name access counter device, implemented at least partially by hardware, that determines, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
- a rule execution device, implemented at least partially by hardware, that performs an action for each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion according to one or more rules associated with the accessed domain name.
Dependencies are inferred from the claim text.