# US 2016/0366154 A1 · Domain classification using domain co-occurrence information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366154 A1
- Document ID: US20160366154A1
- Status: Published application
- Kind: A1
- Application number: 15/248,468
- Filed: 2016-08-26
- Published: 2016-12-15
- Earliest claimed: 2013-07-10
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Frank Denis
- Web page: https://patentgrep.com/patent/US20160366154A1

## CPC

- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
- H04L 61/4511: using domain name system [DNS]
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 2463/144: Detection or countermeasures against botnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Domain classification based on domain co-occurrence information derived from client request behavior is provided. The network requests of clients are analyzed to determine domain and time information. Distance information is generated based on the time between requests for a plurality of domains. The distance information for individual clients is combined to generate distance information for domain pairs. The distance information represents an amount of time or other measurement between queries associated with the two domains of the pair. By examining the client requests, a measure of the distance or relatedness of two domains may be determined. Co-occurrence information for a first set of domains is generated based on the co-occurrence of domains in the first set with domains in a second set of domains. Based on the co-occurrence information, a domain classification can be generated for domains in the first set of domains.

## Claims

### Claim 1

A method of processing communication in a computer network, comprising:
accessing information related to requests from a plurality of clients for a plurality of domains, the information including for each client a list of domains associated with requests from the client;
generating distance information based on requests for domains in a first set of the plurality of domains and requests for domains in a second set of the plurality of domains, wherein the distance information includes information for domain pairs based on requests for one domain from the first set and requests for one domain from the second set;
for each domain in the first set of domains, generating co-occurrence information based on the distance information for each domain pair including said each domain; and
generating a domain classification for the first set of domains based on the co-occurrence information, wherein generating the co-occurrence information comprises iteratively generating the co-occurrence information for the first set of domains including removing domains from the first set of domains and adding domains removed from the first set to the second set of domains.

### Claim 2 (depends on 1)

The method according to claim 1, wherein generating distance information includes, for each domain pair:
determining time difference information for each client that is associated with the domain pair, the time difference information being based on requests from said each client for the one domain from the first set and the one domain from the second set; and
combining the time difference information for each client to generate a distance score for each domain pair.

### Claim 3 (depends on 2)

The method according to claim 2, wherein generating co-occurrence information includes, for each domain in the first set of domains:
combining the distance score for each domain pair including said each domain to create a co-occurrence score for said each domain in the first set of domains.

### Claim 4 (depends on 3)

The method according to claim 3, wherein generating distance information includes:
generating a distance score for domain pairs including a first domain from the first set and a second domain from the first set.

### Claim 5 (depends on 4)

The method according to claim 4, wherein generating co-occurrence information further includes, for each domain in the first set of domains:
using the distance score for domain pairs including said each domain and another domain from the first set of domains in combination with the distance score for domain pairs including said each domain and a domain in the second set of domains to create the co-occurrence score for said each domain.

### Claim 6 (depends on 1)

The method according to claim 1, further comprising:
receiving a plurality of domain name system (DNS) requests from the plurality of clients for the plurality of domains; and
generating a plurality of DNS replies for the plurality of DNS requests based on the domain classification for the first set of domains.

### Claim 7 (depends on 6)

The method according to claim 6, wherein generating a domain classification for the first set of domains comprises:
determining for each domain in the first set of domains whether the co-occurrence information for each domain indicates an association with malware; and
updating domain name information for a first domain in the first set of domains having co-occurrence information indicating an association with malware.

### Claim 8 (depends on 7)

The method according to claim 7, wherein:
the plurality of DNS requests includes a first DNS request for domain name information associated with the first domain; and
generating the plurality of DNS replies includes generating a first DNS reply for the first DNS request including domain name information associated with an alternate domain in response to the domain name information for the first domain.

### Claim 9 (depends on 1)

The method according to claim 1, wherein:
the second set of domains are suspicious domains; and
generating a domain classification for the first set of domains includes indicating that one or more domains in the first set are suspicious domains.

### Claim 10

A non-transitory computer readable storage medium having computer readable instructions for programming a processor to perform a method of domain classification, the method comprising:
accessing information related to requests from a plurality of clients for a plurality of domains, the information including for each client a list of domains associated with requests from the client;
generating distance information based on requests for domains in a first set of the plurality of domains and requests for domains in a second set of the plurality of domains, wherein the distance information includes information for domain pairs based on requests for one domain from the first set and requests for one domain from the second set;
for each domain in the first set of domains, generating co-occurrence information based on the distance information for each domain pair including said each domain; and
generating a domain classification for the first set of domains based on the co-occurrence information;
wherein generating the co-occurrence information comprises iteratively generating the co-occurrence information for the first set of domains including removing domains from the first set of domains and adding domains removed from the first set to the second set of domains.

### Claim 11 (depends on 10)

The computer readable storage medium according to claim 10, wherein generating distance information includes, for each domain pair:
determining time difference information for each client that is associated with the domain pair, the time difference information being based on requests from said each client for one domain from the first set and one domain from a second set of domains; and
combining the time difference information for each client to generate a distance score for each domain pair.

### Claim 12 (depends on 11)

The computer readable storage medium according to claim 11, wherein generating co-occurrence information includes, for each domain in the first set of domains:
combining the distance score for each domain pair including said each domain to create a co-occurrence score for said each domain in the first set of domains.

### Claim 13 (depends on 12)

The computer readable storage medium according to claim 12, wherein generating distance information includes:
generating a distance score for domain pairs including a first domain from the first set and a second domain from the first set.

### Claim 14 (depends on 13)

The computer readable storage medium according to claim 13, wherein generating co-occurrence information further includes, for each domain in the first set of domains:
using the distance score for domain pairs including said each domain and another domain from the first set of domains in combination with the distance score for domain pairs including said each domain and a domain in the second set of domains to create the co-occurrence score for said each domain.

### Claim 15 (depends on 10)

The computer readable storage medium according to claim 10, wherein:
the second set of domains are suspicious domains; and
generating a domain classification for the first set of domains includes indicating that one or more domains in the first set are suspicious domains.

### Claim 16

An apparatus comprising:
at least one storage device including information related to requests from a plurality of clients for a plurality of domains, the information including for each client a list of domains associated with requests from the client;
a processor in communication with the at least one storage device, the processor executes computer readable instructions to perform operations including:
generating distance information based on requests for domains in a first set of the plurality of domains and requests for domains in a second set of the plurality of domains, wherein the distance information includes information for domain pairs based on requests for one domain from the first set and requests for one domain from the second set;
for each domain in the first set of domains, generating co-occurrence information based on the distance information for each domain pair including said each domain; and
generating a domain classification for the first set of domains based on the co-occurrence information, wherein generating the co-occurrence information comprises iteratively generating the co-occurrence information for the first set of domains including removing domains from the first set of domains and adding domains removed from the first set to the second set of domains.

### Claim 17 (depends on 16)

The apparatus according to claim 16, wherein the processor generates distance information by, for each domain pair:
determining time difference information for each client that is associated with the domain pair, the time difference information being based on requests from said each client for the one domain from the first set and one domain from a second set of domains; and
combining the time difference information for each client to generate a distance score for each domain pair.

### Claim 18 (depends on 17)

The apparatus according to claim 17, wherein the processor generates co-occurrence information for each domain in the first set of domains by:
combining the distance score for each domain pair including said each domain to create a co-occurrence score for said each domain in the first set of domains.

### Claim 19 (depends on 18)

The apparatus according to claim 18, wherein the processor generates distance information by:
generating a distance score for domain pairs including a first domain from the first set and a second domain from the first set.

### Claim 20 (depends on 19)

The apparatus according to claim 19, wherein the processor generates co-occurrence information by, for each domain in the first set of domains:
using the distance score for domain pairs including said each domain and another domain from the first set of domains in combination with the distance score for domain pairs including said each domain and a domain in the second set of domains to create the co-occurrence score for said each domain.