Performing rule-based actions for newly observed domain names
AssigneeSplunk Inc.
InventorMunawar Monzy Merza
Life of this patent
Estimating the term…
Abstract
Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.
Claims17
A method, comprising:
- extracting a set of accessed domain names from network traffic data;
- adding an accessed domain name in the set of accessed domain names to a data structure that associates the accessed domain name with a time at which the accessed domain name was observed in the network traffic data;
- identifying a subset of accessed domain names in the set of accessed domain names that were accessed during a particular time period, wherein the subset of accessed domain names includes the accessed domain name;
- determining that the accessed domain name in the subset of accessed domain names was not accessed prior to the particular time period, wherein determining that the accessed domain name was not accessed prior to the particular time period includes:
- searching the data structure for the accessed domain name, and
- determining that the accessed domain name was not accessed prior to the particular time period based on the time at which the accessed domain name was observed in the network traffic data being greater than a maximum age value;
- based on determining that the accessed domain name was not accessed prior to the particular time period, performing an action according to one or more rules;
- and
- wherein the method is performed by one or more computing devices.
One or more non-transitory computer-readable media, storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:
- extracting a set of accessed domain names from network traffic data;
- adding an accessed domain name in the set of accessed domain names to a data structure that associates the accessed domain name with a time at which the accessed domain name was observed in the network traffic data;
- identifying a subset of accessed domain names in the set of accessed domain names that were accessed during a particular time period, wherein the subset of accessed domain names includes the accessed domain name;
- determining that the accessed domain name in the subset of accessed domain names was not accessed prior to the particular time period, wherein determining that the accessed domain name was not accessed prior to the particular time period includes:
- searching the data structure for the accessed domain name, and
- determining that the accessed domain name was not accessed prior to the particular time period based on the time at which the accessed domain name was observed in the network traffic data being greater than a maximum age value;
- based on determining that the accessed domain name is not identified as accessed prior to the particular time period, performing an action according to one or more rules.
Dependencies are inferred from the claim text.