Patent ID: 9053320
Filing Date: 2015-06-09
Classification: G06F,H04L

Abstract:
1. A method of identifying one or more sources of machine-generated domain resolution requests, the method comprising: defining a plurality of taxonomical sets to contain character strings having particular syntax characteristics, wherein each of the plurality of taxonomical sets is either for character strings of domains having machine generated syntax characteristics, or for character strings of domains having non-machine generated syntax characteristics, wherein the plurality of taxonomical sets include a set of unresolvable domains exhibiting a syntax characteristic of existing registered domains, wherein the syntax characteristic of existing registered domains is selected from the set of syntax characteristics consisting of: maintaining a log of requests to one or more DNS servers to resolve unresolvable domains, each request made by a requestor; identifying, after the defining, from among the requests a set of unresolvable domains requested within a given time period; classifying, after the defining, the domains within the set of unresolvable domains into the plurality of taxonomical sets; maintaining a count of a number of requests for each unresolvable domain made by each requestor within each of the taxonomical sets; and identifying requestors exhibiting a threshold level of machine generated traffic directed to at least one unresolvable domain based at least in part on at least one count of the number of requests for each unresolvable domain made by each requestor within each of the taxonomical sets.