US 11,695,667 B2Granted

Query prints (Qprints): telemetry-based similarity for DNS

AssigneeInfoblox Inc.

InventorRenée Carol Burton

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for Qprints using telemetry-based similarity for DNS are provided. In some embodiments, a system/process/computer program product for Qprints using telemetry-based similarity for DNS in accordance with some embodiments includes aggregating a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data; clustering the DNS related query data; and generating similarity clusters for domains based on their DNS related query data. For example, the set of network related event data can include passive DNS (pDNS) data aggregated over a period of time to express pDNS data at-scale, and similarity of the pDNS data aggregated over the period of time is quantified, within and across networks based on telemetry-based similarity for DNS using a statistical model.

Claims20

Dependent claims

A system, comprising:

a processor configured to:
aggregate a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related query data;
cluster the DNS related query data, comprising to:
create a bag-of-words model for a given domain based on a set of all queries for the given domain associated with the set of network related event data during a particular set of time, wherein a word of the bag-of-words model relates to a combination of a response code (rcode) and a query type, wherein the rcode corresponds to a result of a DNS request;
and
group domains having similar behavior;
and
generate similarity clusters for domains based on their DNS related query data, comprising to:
identify domains that are similar to the given seed domain based on a feature distribution, wherein domains that are similar to the given seed domain are identified using term frequency-inverse document frequency (TF-IDF);
and
a memory coupled to the processor and configured to provide the processor with instructions.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/535,226Filed 24 Nov 2021 · us provisional application
Priority: 25 Nov 2020
Published: US 2022/0166692 A126 May 2022
Granted: 4 Jul 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 41/142
Network analysis or design: using statistical or mathematical methods
H04L 43/067
Generation of reports: using time frame reporting
H04L 43/04
Arrangements for monitoring or testing data switching networks: processing captured monitoring data, e.g. for logfile generation
H04L 43/0817
By checking availability: by checking functioning