Patent ID: 9680842
Date: 2017-06-13
CPC Classifications: H04L

Claim:
1. A computer-implemented method for detecting aberrant domain name system (DNS) resolution requests, the method comprising: obtaining over a computer network a plurality of DNS name resolution requests received over a period of time by a plurality of DNS name servers; generating, using a sliding time window with a fixed duration, electronically represented sets of lists, one set of lists for each of the plurality of DNS name servers, each list comprising a plurality of domains requested within the fixed duration; combining the sets of lists, by at least one electronic processor, whereby a global set of lists is generated; identifying, by at least one electronic processor, a co-occurring list that appears at least twice in the global set of lists, wherein the co-occurring list that appears at least twice in the global set of lists comprises a particular plurality of DNS name resolution requests that have been received by the plurality of DNS name servers at least twice; determining, by at least one electronic processor, that a plurality of domains in the co-occurring list are non-existent; and indicating, by at least one electronic processor, the plurality of domains in the co-occurring list that are non-existent.