Community detection based on dns querying patterns
AssigneeInfoblox Inc.
InventorAruna Chakkirala
Life of this patent
Estimating the term…
Abstract
Techniques for community detection based on DNS querying patterns are disclosed. For example, techniques for community detection based on DNS querying patterns for anomaly detection and monitoring efficiencies are disclosed. In some embodiments, a system, process, and/or computer program product for community detection based on DNS querying patterns includes receiving DNS log files, wherein the DNS log files include a DNS query and a DNS response for resolution of the DNS query; generating a graph based on the DNS log files; identifying a plurality of communities using the graph based on DNS querying patterns; and detecting an anomaly in DNS activity associated with one or more of the communities based on a DNS querying rule.
Claims20
A system, comprising:
- a processor configured to:
- receive DNS log files, wherein the DNS log files include a DNS query and a DNS response for resolution of the DNS query;
- generate a graph based on the DNS log files;
- identify a plurality of communities using the graph based on DNS querying patterns;
- and
- detect an anomaly in DNS activity associated with one or more of the communities based on a DNS querying rule;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving DNS log files, wherein the DNS log files include a DNS query and a DNS response for resolution of the DNS query;
- generating a graph based on the DNS log files;
- identifying a plurality of communities using the graph based on DNS querying patterns;
- and
- detecting an anomaly in DNS activity associated with one or more of the communities based on a DNS querying rule.
A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
- receiving DNS log files, wherein the DNS log files include a DNS query and a DNS response for resolution of the DNS query;
- generating a graph based on the DNS log files;
- identifying a plurality of communities using the graph based on DNS querying patterns;
- and
- detecting an anomaly in DNS activity associated with one or more of the communities based on a DNS querying rule.
Dependencies are inferred from the claim text.