Clustering-based security monitoring of accessed domain names
AssigneeSplunk Inc.
InventorMunawar Monzy Merza
Life of this patent
Estimating the term…
Abstract
Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.
Claims20
A computer-implemented method, comprising:
- extracting, by one or more computing devices, a set of accessed domain names from network traffic data;
- adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
- a time at which the accessed domain name was observed in the network traffic data, and
- a time at which the accessed domain name was registered at a registrar;
- using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name;
- and
- performing an action relative to the accessed domain name associated with the outlier cluster.
A computing device, comprising:
- a processor;
- and
- a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
- extracting a set of accessed domain names from network traffic data;
- adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
- a time at which the accessed domain name was observed in the network traffic data, and
- a time at which the accessed domain name was registered at a registrar;
- using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name;
- and
- performing an action relative to the accessed domain name associated with the outlier cluster.
A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:
- extracting a set of accessed domain names from network traffic data;
- adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
- a time at which the accessed domain name was observed in the network traffic data, and
- a time at which the accessed domain name was registered at a registrar;
- using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name;
- and
- performing an action relative to the accessed domain name associated with the outlier cluster.
Dependencies are inferred from the claim text.