Clustering-based security monitoring of accessed domain names

Patent metadata

Field	Value
Publication number	US-11606384-B2
Application number	US-202117386989-A
Country	US
Kind code	B2
Filing date	Jul 28, 2021
Priority date	Jul 25, 2013
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
extracting, by one or more computing devices, a set of accessed domain names from network traffic data;
adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
a time at which the accessed domain name was observed in the network traffic data, and
a time at which the accessed domain name was registered at a registrar;

using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name; and
performing an action relative to the accessed domain name associated with the outlier cluster.

2. The method of claim 1 , wherein the action includes blocking access to the accessed domain name associated with the outlier cluster.

3. The method of claim 1 , wherein the action includes preventing a device from accessing the accessed domain name associated with the outlier cluster.

4. The method of claim 1 , wherein the action includes causing an alert to be generated that identifies the accessed domain name associated with the outlier cluster.

5. The method of claim 1 , further comprising:
receiving input specifying a rule, wherein the rule identifies the accessed domain name and the action;
identifying the accessed domain name in additional network traffic data;
determining that the rule applies to the accessed domain name; and
performing the action.

6. The method of claim 1 , further comprising receiving user input specifying a time period, and wherein the network traffic data is associated with timestamps within the time period.

7. The method of claim 1 , wherein the accessed domain name is a first accessed domain name, and wherein the method further comprises:
identifying a second accessed domain name associated with the outlier cluster; and
performing an action relative to the second accessed domain name associated with the outlier cluster.

8. The method of claim 1 , wherein the network traffic data is stored as timestamped events in a data store, and wherein the timestamped events are stored in the data store based on a timestamp associated with each event.

9. The method of claim 1 , further comprising filtering the network traffic data based on a request method associated with messages of the network traffic data.

10. The method of claim 1 , wherein each accessed domain name in the set of accessed domain names corresponds to an accessed webpage.

11. The method of claim 1 , further comprising causing display of information related to the accessed domain name.

12. The method of claim 1 , further comprising causing display of information related to a subset of accessed domain names including the accessed domain name in a scatter plot graph.

13. The method of claim 1 , further comprising causing display of information related to a subset of accessed domain names including the accessed domain name in a table.

14. A computing device, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
extracting a set of accessed domain names from network traffic data;
adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
a time at which the accessed domain name was observed in the network traffic data, and
a time at which the accessed domain name was registered at a registrar;

using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name; and
performing an action relative to the accessed domain name associated with the outlier cluster.

15. The computing device of claim 14 , wherein the action includes blocking access to the accessed domain name associated with the outlier cluster.

16. The computing device of claim 14 , wherein the action includes preventing a device from accessing the accessed domain name associated with the outlier cluster.

17. The computing device of claim 14 , wherein the action includes causing an alert to be generated that identifies the accessed domain name associated with the outlier cluster.

18. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:
extracting a set of accessed domain names from network traffic data;
adding the set of accessed domain names to a data structure that associates each accessed domain name with data points including:
a time at which the accessed domain name was observed in the network traffic data, and
a time at which the accessed domain name was registered at a registrar;

using a clustering algorithm to identify an accessed domain name associated with an outlier cluster, wherein the clustering algorithm clusters the set of accessed domain names based on the data points associated with each domain name; and
performing an action relative to the accessed domain name associated with the outlier cluster.

19. The non-transitory computer-readable medium of claim 18 , wherein the action includes blocking access to the accessed domain name associated with the outlier cluster.

20. The non-transitory computer-readable medium of claim 18 , wherein the action includes preventing a device from accessing the accessed domain name associated with the outlier cluster.

Assignees

• Splunk Inc

Inventors

• Merza Munawar Monzy

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• A61G17/041

  Handles · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• A61G17/0073

  Cardboard · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title