# US 11,121,947 B2 · Monitoring and analysis of interactions between network endpoints > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,947 B2 - Document ID: US11121947B2 - Status: Granted - Kind: B2 - Application number: 16/659,331 - Filed: 2019-10-21 - Published: 2020-05-28 - Granted: 2021-09-14 - Earliest claimed: 2015-02-25 - Assignees: Infoblox Inc. - Applicants: Infoblox Inc. - Inventors: Sandhya Narayan; Stuart M. Bailey - Web page: https://patentgrep.com/patent/US11121947B2 ## CPC - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/026: using flow identification - H04L 43/0823: Errors, e.g. transmission errors - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 61/4511: using domain name system [DNS] - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 43/045: for graphical visualisation of monitoring data - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/306: User profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for monitoring and analysis of interactions between network endpoints are disclosed. In some embodiments, a process for monitoring and analysis of interactions between network endpoints includes collecting Domain Name System (DNS) response data from a network device; determining network endpoint interactions based on an analysis of the DNS response data (e.g., using a processor); and generating a graph corresponding to the network endpoint interactions. For example, the network device can include a DNS device and/or a software-defined networking (SDN) device (e.g., an SDN switch, such as an OpenFlow switch). ## Claims ### Claim 1 A system for monitoring and analysis of interactions between network endpoints, comprising: a processor configured to: collect Domain Name System (DNS) response data from a network device, comprising to: identify DNS responses from the network device that match User Datagram Protocol (UDP) port 53; determine network endpoint interactions based on an analysis of the DNS response data; generate a graph corresponding to the network endpoint interactions; group, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions; determine whether anomalous network activity has occurred based on an analysis of the generated graph, comprising to: compare a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determine that the anomalous network activity has occurred; and in response to a determination that the anomalous network activity has occurred, perform a remedial action; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the network device includes a DNS device. ### Claim 3 (depends on 1) The system of claim 1, wherein the network device includes a software-defined networking (SDN) device. ### Claim 4 (depends on 1) The system of claim 1, wherein the network device includes a DNS device and/or a software-defined networking (SDN) device. ### Claim 5 (depends on 1) The system of claim 1, wherein the network device includes a software-defined networking (SDN) switch. ### Claim 6 (depends on 1) The system of claim 1, wherein the network device includes an OpenFlow switch. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is further configured to: store the DNS response data in a data store. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor is further configured to: execute a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor is further configured to: configure a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform. ### Claim 10 (depends on 1) The system of claim 1, wherein the processor is further configured to: generate a report based on an analysis of the network endpoint interactions for a plurality of network endpoints internal to an enterprise network. ### Claim 11 A method for monitoring and analysis of interactions between network endpoints, comprising: collecting Domain Name System (DNS) response data from a network device, comprising: identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53; determining network endpoint interactions based on an analysis of the DNS response data; generating a graph corresponding to the network endpoint interactions; grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions; determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising: comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and in response to a determination that the anomalous network activity has occurred, performing a remedial action. ### Claim 12 (depends on 11) The method of claim 11, wherein the network device includes a DNS device and/or a software-defined networking (SDN) device. ### Claim 13 (depends on 11) The method of claim 11, further comprising: storing the DNS response data in a data store. ### Claim 14 (depends on 11) The method of claim 11, further comprising: executing a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device. ### Claim 15 (depends on 11) The method of claim 11, further comprising: configuring a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform. ### Claim 16 A computer program product for monitoring and analysis of interactions between network endpoints, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: collecting Domain Name System (DNS) response data from a network device, comprising: identifying DNS responses from the network device that match User Datagram Protocol (UDP) port 53; determining network endpoint interactions based on an analysis of the DNS response data; generating a graph corresponding to the network endpoint interactions; grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions; determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising: comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and in response to a determination that the anomalous network activity has occurred, performing a remedial action. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the network device includes a DNS device and/or a software-defined networking (SDN) device. ### Claim 18 (depends on 16) The computer program product recited in claim 16, further comprising computer instructions for: storing the DNS response data in a data store. ### Claim 19 (depends on 16) The computer program product recited in claim 16, further comprising computer instructions for: executing a telemetry platform, wherein the telemetry platform includes a controller for collecting the DNS response data from the network device. ### Claim 20 (depends on 16) The computer program product recited in claim 16, further comprising computer instructions for: configuring a software-defined networking (SDN) device to send the DNS response data to a controller of a telemetry platform. ### Claim 21 A system for monitoring and analysis of interactions between network endpoints, comprising: a controller for collecting network data from a plurality of network devices in an enterprise network, wherein the collecting of the network data comprises identifying DNS responses from the plurality of network devices that match User Datagram Protocol (UDP) port 53; a data store in communication with the controller for storing the network data; an analyzer in communication with the data store for performing an analysis of the network data to determine interactions between network endpoints; a graphics visualizer in communication with the analyzer for generating a graph based on the interactions between network endpoints, and grouping, using the graph, the network endpoint interactions over a period of time to obtain a group of endpoint interactions; and a determiner in communication with the graphics visualize for determining whether anomalous network activity has occurred based on an analysis of the generated graph, comprising: comparing a first number of a first group of endpoint interactions over a current period of time with a second number of a second group of endpoint interactions over a previous period of time; and in response to a determination that a difference between the first number and the second number meets or exceeds a threshold, determining that the anomalous network activity has occurred; and in response to a determination that the anomalous network activity has occurred, performing a remedial action. ### Claim 22 (depends on 21) The system of claim 21, wherein the plurality of network devices includes physical network devices, virtual network devices, and/or software-defined networking (SDN) devices. ### Claim 23 (depends on 21) The system of claim 21, wherein the network data includes Domain Name System (DNS) responses. ### Claim 24 (depends on 21) The system of claim 21, further comprising: a data aggregator in communication with the controller for aggregating the network data. ### Claim 25 (depends on 21) The system of claim 21, further comprising: a web server in communication with the analyzer for web-based network communications with the system.