Blocking domain name access using access patterns and domain name registrations

Patent metadata

Field	Value
Publication number	US-9756068-B2
Application number	US-201715475120-A
Country	US
Kind code	B2
Filing date	Mar 30, 2017
Priority date	Jul 25, 2013
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.

First claim

What is claimed is:

1. A method, comprising:
extracting a set of accessed domain names from a set of events stored in a field-searchable data store;
identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar;
identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion;
determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
blocking future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion; wherein the method is performed by one or more computing devices.

2. The method of claim 1 , further comprising:
receiving a communication corresponding to an indication as to when each accessed domain name in the subset was registered with a registrar;
wherein the respective registration time is identified based on the communication.

3. The method of claim 1 , wherein the respective registration time comprises an age from a first time when the accessed domain name was registered with the registrar to a current time.

4. The method of claim 1 , wherein the respective registration time is identified based on a communication received from Internet Corporation for Assigned Names and Numbers (ICANN).

5. The method of claim 1 , wherein identifying a subset of accessed domain names further comprises:
determining that a particular accessed domain name in the set of accessed domain names has not been detected in events received prior to the receipt of the set of events;
identifying a first access time of the particular accessed domain name based on a time of receipt of an event in the set of events that includes the particular accessed domain name or based on a time included in events in the set of events that includes the particular accessed domain name;
wherein the first access time is used as the respective registration time for the particular accessed domain name.

6. The method of claim 1 , wherein the first criterion is based on a recency of registration.

7. The method of claim 1 , wherein the first criterion is based on registration within a defined time period.

8. The method of claim 1 , wherein the first criterion is based on access by particular parties.

9. The method of claim 1 , wherein the second criterion is based on a threshold count.

10. The method of claim 1 , wherein each accessed domain name in the set of accessed domain names corresponds to an accessed Web page.

11. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause:
extracting a set of accessed domain names from a set of events stored in a field-searchable data store;
identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar;
identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion;
determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
blocking future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion.

12. The one or more non-transitory storage media of claim 11 , wherein the instructions which, when executed by one or more computing devices, further cause:
receiving a communication corresponding to an indication as to when each accessed domain name in the subset was registered with a registrar;
wherein the respective registration time is identified based on the communication.

13. The one or more non-transitory storage media of claim 11 , wherein the respective registration time comprises an age from a first time when the accessed domain name was registered with the registrar to a current time.

14. The one or more non-transitory storage media of claim 11 , wherein identifying a subset of accessed domain names further comprises:
determining that a particular accessed domain name in the set of accessed domain names has not been detected in events received prior to the receipt of the set of events;
identifying a first access time of the particular accessed domain name based on a time of receipt of an event in the set of events that includes the particular accessed domain name or based on a time included in one or more events in the set of events that includes the particular accessed domain name;
wherein the first access time is used as the respective registration time for the particular accessed domain name.

15. The one or more non-transitory storage media of claim 11 , wherein the second criterion is based on a threshold count.

16. An apparatus, comprising:
an event extraction device, implemented at least partially by hardware, that extracts a set of accessed domain names from a set of events stored in a field-searchable data store;
a domain name evaluation device, implemented at least partially by hardware, that identifies a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; wherein the domain name evaluation device identifies a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion;
a domain name access counter device, implemented at least partially by hardware, that determines, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed;
a domain name blocking device, implemented at least partially by hardware, that blocks future access to each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion.

17. The apparatus of claim 16 , further comprising:
a registrar communication receiver, implemented at least partially by hardware, that receives a communication corresponding to an indication as to when each accessed domain name in the subset was registered with a registrar;
wherein the respective registration time is identified based on the communication.

18. The apparatus of claim 16 , wherein the respective registration time comprises an age from a first time when the accessed domain name was registered with the registrar to a current time.

19. The apparatus of claim 16 , wherein the domain name evaluation device determines that a particular accessed domain name in the set of one or more accessed domain names has not been detected in events received prior to the receipt of the set of events, wherein the domain name evaluation device identifies a first access time of the particular accessed domain name based on a time of receipt of an event in the set of events that includes the particular accessed domain name or based on a time in

Assignees

• Splunk Inc

Inventors

• Merza Munawar Monzy

Classifications

• A61G17/042

  Linings and veneer · CPC title

• A61G17/041

  Handles · CPC title

• A61G17/044

  Corpse supports · CPC title

• A61G17/0073

  Cardboard · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title