Systems and methods for detecting similarities in network traffic
AssigneeVeriSign, Inc.
InventorsMatthew Thomas, Nipun Jawalkar
Life of this patent
Estimating the term…
Abstract
A system, computer-readable medium, and method for identifying similarities in network traffic are provided. Hash values are calculated from Internet Protocol (IP) addresses in a group of IP addresses that request a domain name, a hash signature is generated from the hash values and paired with the domain name, and the domain name is then clustered with another domain name having a paired hash of the same value. The clustered domain names are then extracted and used in a similarity calculation.
Claims20
A computer-implemented method for detecting similar network activity, the method being carried out by a computer system having at least one processor, the method comprising:
- receiving records comprising groups of Internet Protocol (IP) addresses and a plurality of domains, a first group of the groups of IP addresses being associated with a first domain of the plurality of domains;
- applying, by the at least one processor, a first hash function to compute a first plurality of hash values for the first group, the first plurality of hash values including hash values for IP addresses in the first group;
- selecting a first hash value of the first plurality of hash values to determine a hash signature;
- outputting the hash signature and the first domain as a first pair;
- grouping the first pair with a second pair, the second pair comprising a second hash signature having a same value as the first hash signature and a second domain;
- and
- outputting the first domain and the second domain as a set of domains for use as candidates in a similarity computation.
A computer system for detecting similar network activity, the computer system comprising:
- a memory storing instructions;
- and
- a processor that, upon executing the stored instructions, is configured to:
- receive records comprising groups of Internet Protocol (IP) addresses and a plurality of domains, a first group of the groups of IP addresses being associated with a first domain of the plurality of domains;
- apply a first hash function to compute a first plurality of hash values for the first group, the first plurality of hash values including hash values for IP addresses in the first group;
- select a first hash value of the first plurality of hash values to determine a hash signature;
- output the hash signature and the first domain as a first pair;
- group the first pair with a second pair, the second pair comprising a second hash signature having a same value as the first hash signature and a second domain;
- and
- output the first domain and the second domain as a set of domains for use as candidates in a similarity computation.
A non-transitory computer-readable storage medium containing instructions that, when executed by a processor, cause the processor to perform a method comprising:
- receiving records comprising groups of Internet Protocol (IP) addresses and a plurality of domains, a first group of the groups of IP addresses being associated with a first domain of the plurality of domains;
- applying a first hash function to compute a first plurality of hash values for the first group, the first plurality of hash values including hash values for IP addresses in the first group;
- selecting a first hash value of the first plurality of hash values to determine a hash signature;
- outputting the hash signature and the first domain as a first pair;
- grouping the first pair with a second pair, the second pair comprising a second hash signature having a same value as the first hash signature and a second domain;
- and
- outputting the first domain and the second domain as a set of domains for use as candidates in a similarity computation.
Dependencies are inferred from the claim text.