# US 2025/0097238 A1 · Dns automated intelligence

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0097238 A1
- Document ID: US20250097238A1
- Status: Published application
- Kind: A1
- Application number: 18/679,186
- Filed: 2024-05-30
- Published: 2025-03-20
- Earliest claimed: 2023-09-15
- Assignees: Infoblox Inc.
- Applicants: Infoblox Inc.
- Inventors: Renée Carol Burton; Christopher June Kim; Laura Teixeira da Rocha; Chance Mitchell Tudor
- Web page: https://patentgrep.com/patent/US20250097238A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Various techniques for providing a DNS automated intelligence solution are disclosed. In some embodiments, a DNS Automated Intelligence System (DAISy) is disclosed that includes a system designed to create threat intelligence for use in protective DNS, or DNS Detection and Response systems which control access to internet resources at a DNS resolver. The disclosed DAISy solution includes the ingestion of raw source data, the curation and refinement of this source data into specialized data sets used for identifying threats, active processes to increase visibility into internet domain names, and can also include human-in-the-loop acceleration that allows for rapid automation, and a modular incorporation of DNS-specific signatures for identification of suspicious domain names. The disclosed DAISy solution is self-sustaining, automated, and incorporates human guidance. Moreover, it is effective for scaling the detection of malicious and suspicious domains, which is not possible with existing traditional approaches to DNS security.

## Claims

### Claim 1

A system, comprising:
a processor configured to:
selectively aggregate DNS data from a plurality of networks;
automatically classify meaningful DNS resources from the aggregated DNS data; and
send new threat domains to a DNS threat feed; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 2 (depends on 1)

The system recited in claim 1, wherein a new domain server is identified as malicious.

### Claim 3 (depends on 1)

The system recited in claim 1, wherein a new domain server is identified as a compromised or an inherently malicious or suspicious name server.

### Claim 4 (depends on 1)

The system recited in claim 1, wherein a new domain server is identified as a compromised or an inherently malicious or suspicious name server, and wherein new domains associated with the new domain server are monitored to identify new malicious domains.

### Claim 5 (depends on 1)

The system recited in claim 1, wherein the aggregated DNS data is collected from a plurality of monitored enterprise, university, and/or government networks.

### Claim 6 (depends on 1)

The system recited in claim 1, wherein a new threat domain is identified.

### Claim 7 (depends on 1)

The system recited in claim 1, wherein a new threat domain is identified, and wherein an action is performed in response to detecting the new threat domain.

### Claim 8 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to perform the following action in response to identification of a new threat domain:
block the new threat domain in near real-time at a DNS security platform, wherein the new threat domain is blocked at least for a predetermined period of time.

### Claim 9 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to:
report a new threat domain for a first network based on a DNS security policy associated with the first network.

### Claim 10 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to:
quarantine an unclassified domain for further security professional review to update configuration for a classifier.

### Claim 11 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to:
automatically generate a new DNS signature for a new DNS threat using a statistical classifier.

### Claim 12 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to:
periodically revisit the new threat domains during a predetermined time window to update threat intelligence information associated with the new threat domains.

### Claim 13

A method, comprising:
selectively aggregating DNS data from a plurality of networks;
automatically classifying meaningful DNS resources from the aggregated DNS data; and
sending new threat domains to a DNS threat feed.

### Claim 14 (depends on 13)

The method of claim 13, wherein a new domain server is identified as malicious.

### Claim 15 (depends on 13)

The method of claim 13, wherein a new domain server is identified as a compromised or an inherently malicious or suspicious name server.

### Claim 16 (depends on 13)

The method of claim 13, wherein a new domain server is identified as a compromised or an inherently malicious or suspicious name server, and wherein new domains associated with the new domain server are monitored to identify new malicious domains.

### Claim 17 (depends on 13)

The method of claim 13, wherein the aggregated DNS data is collected from a plurality of monitored enterprise, university, and/or government networks.

### Claim 18 (depends on 13)

The method of claim 13, wherein a new threat domain is identified.

### Claim 19 (depends on 13)

The method of claim 13, wherein a new threat domain is identified, and wherein an action is performed in response to detecting the new threat domain.

### Claim 20

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
selectively aggregating DNS data from a plurality of networks;
automatically classifying meaningful DNS resources from the aggregated DNS data; and
sending new threat domains to a DNS threat feed.