Back to results
US 8,819,227 B1Granted
Discerning web content and services based on real-time DNS tagging
AssigneeNarus, Inc.
InventorsRam Keralapura, Marco Mellia, Ignacio Bermudez, Antonio Nucci
Life of this patent
Estimating the term…
Abstract
A method for profiling network traffic of a network, including obtaining a plurality of flows comprising a plurality of client IP addresses, a plurality of server IP addresses, and a plurality of server ports, extracting a plurality of fully qualified domain names (FQDNs) from a plurality of DNS flows in the network traffic, analyzing correlation between the plurality of flows and the plurality of FQDNs to generate a result, and presenting the result to an administrator user of the network.
Claims16
A method for profiling network traffic of a network, comprising:
- obtaining, by a processor of a computer system and from the network traffic, a plurality of domain name service (DNS) flows comprising a plurality of client Internet protocol (IP) addresses, a plurality of fully qualified domain names (FQDNs), and a plurality of server IP addresses,
- wherein the plurality of DNS flows comprise a DNS query that is initiated from a client IP address of the plurality of client IP addresses to request service based on a FQDN of the plurality of FQDNs that is contained in the DNS query, and
- wherein the plurality of server IP addresses comprise a server IP address that is resolved by a DNS server in the network based on the FQDN as requested from the client IP address and returned in a DNS response contained in the plurality of DNS flows;
- analyzing, by the processor, the plurality of DNS flows to generate a mapping between the plurality of client IP addresses, the plurality of server IP addresses, and the plurality of FQDNs;
- storing the mapping in a data structure separate from the DNS server, wherein each of the plurality of client IP addresses and each of the plurality of server IP addresses form a client/server IP address pair that is used as input to the data structure for looking up one of the plurality of FQDNs as output of the data structure;
- and
- analyzing the network traffic based on the data structure to generate a result of profiling the network traffic, wherein analyzing the network traffic based on the data structure comprises:
- obtaining, from the network traffic, a plurality of flows comprising a first portion of the plurality of client IP addresses, a second portion of the plurality of server IP addresses, and a plurality of server ports;
- tagging the plurality of flows using corresponding FQDNs that are looked up using the data structure based on the first portion of the plurality of client IP addresses and the second portion of the plurality of server IP addresses contained in the plurality of flows;
- storing the plurality of flows in association with the corresponding FQDNs in a repository as a plurality of tagged flows;
- and
- tallying a plurality of portions of the plurality of tagged flows to generate a plurality of tallies,
- wherein at least one portion of the plurality of portions is defined based on a common FQDN among the plurality of FQDNs and a common server port among the plurality of server ports that are shared by all flows in the at least one portion, and
- wherein the result comprises the plurality of tallies.
11 more elements
A system for profiling network traffic of a network, comprising:
- a data collector configured to:
- obtain, from the network traffic, a plurality of domain name service (DNS) flows comprising a plurality of client Internet protocol (IP) addresses, a plurality of fully qualified domain names (FQDNs), and a plurality of server IP addresses,
- wherein the plurality of DNS flows comprise a DNS query that is initiated from a client IP address of the plurality of client IP addresses to request service based on a FQDN of the plurality of FQDNs that is contained in the DNS query, and
- wherein the plurality of server IP addresses comprise a server IP address that is resolved by a DNS server in the network based on the FQDN as requested from the client IP address and returned in a DNS response contained in the plurality of DNS flows;
- and
- an analyzer configured to:
- analyze the plurality of DNS flows to generate a mapping between the plurality of client IP addresses, the plurality of server IP addresses, and the plurality of FQDNs;
- store the mapping in a data structure separate from the DNS server, wherein each of the plurality of client IP addresses and each of the plurality of server IP addresses form a client/server IP address pair that is used as input to the data structure for looking up one of the plurality of FQDNs as output of the data structure;
- and
- analyze the network traffic based on the data structure to generate a result of profiling the network traffic, wherein analyzing the network traffic based on the data structure comprises:
- obtaining, from the network traffic, a plurality of flows comprising a first portion of the plurality of client IP addresses, a second portion of the plurality of server IP addresses, and a plurality of server ports;
- tagging the plurality of flows using corresponding FQDNs that are looked up using the data structure based on the first portion of the plurality of client IP addresses and the second portion of the plurality of server IP addresses contained in the plurality of flows;
- storing the plurality of flows in association with the corresponding FQDNs in a repository as a plurality of tagged flows;
- and
- tallying a plurality of portions of the plurality of tagged flows to generate a plurality of tallies,
- wherein at least one portion of the plurality of portions is defined based on a common FQDN among the plurality of FQDNs and a common server port among the plurality of server ports that are shared by all flows in the at least one portion, and
- wherein the result comprises the plurality of tallies.
14 more elements
A non-transitory computer readable medium embodying instructions for profiling network traffic of a network, the instructions when executed by a processor comprising functionality for:
- obtaining, from the network traffic, a plurality of domain name service (DNS) flows comprising a plurality of client Internet protocol (IP) addresses, a plurality of fully qualified domain names (FQDNs), and a plurality of server IP addresses,
- wherein the plurality of DNS flows comprise a DNS query that is initiated from a client IP address of the plurality of client IP addresses to request service based on a FQDN of the plurality of FQDNs that is contained in the DNS query, and
- wherein the plurality of server IP addresses comprise a server IP address that is resolved by a DNS server in the network based on the FQDN as requested from the client IP address and returned in a DNS response contained in the plurality of DNS flows;
- analyzing the plurality of DNS flows to generate a mapping between the plurality of client IP addresses, the plurality of server IP addresses, and the plurality of FQDNs;
- storing the mapping in a data structure separate from the DNS server, wherein each of the plurality of client IP addresses and each of the plurality of server IP addresses form a client/server IP address pair that is used as input to the data structure for looking up one of the plurality of FQDNs as output of the data structure;
- and
- analyzing the network traffic based on the data structure to generate a result of profiling the network traffic, wherein analyzing the network traffic based on the data structure comprises:
- obtaining, from the network traffic, a plurality of flows comprising a first portion of the plurality of client IP addresses, a second portion of the plurality of server IP addresses, and a plurality of server ports;
- tagging the plurality of flows using corresponding FQDNs that are looked up using the data structure based on the first portion of the plurality of client IP addresses and the second portion of the plurality of server IP addresses contained in the plurality of flows;
- storing the plurality of flows in association with the corresponding FQDNs in a repository as a plurality of tagged flows;
- and
- tallying a plurality of portions of the plurality of tagged flows to generate a plurality of tallies,
- wherein at least one portion of the plurality of portions is defined based on a common FQDN among the plurality of FQDNs and a common server port among the plurality of server ports that are shared by all flows in the at least one portion, and
- wherein the result comprises the plurality of tallies.
11 more elements
Dependencies are inferred from the claim text.