Abstract:
A method predicting a network activity associated with a given network site is provided. The method can include receiving a request to predict a probability of network activity associated with the network site, analyzing historical data associated with the network site, and, based on the analysis, determining the probability of the network activity in future. The method can further include monitoring the network site, ascertaining evidence associated with the network activity, and, based on the evidence, adjusting treatment of the network site. Additionally, the method can include comparing the probability to a predetermined threshold probability and, based on the comparison, selectively taking an action concerning the network site.

Description:
FIELD 
     This application relates generally to data processing and, more specifically, to systems and methods for predicting network activities associated with a given site. 
     BACKGROUND 
     Predicting network activity helps service providers and enterprises manage and react to change within their systems. For example, one of the most pressing problems the Internet community faces today is network activity that enables attackers to gain unauthorized access to resources or disrupt services of a network site. Network acts performed over a network can include various Distributed Denial of Service (DDoS) attacks, spamming, financial information theft, misdirected queries, and so forth. To prevent such network activity, network operators and other organizations can monitor traffic and detect suspicious network activity that is associated with network attacks. Service providers or enterprises can also use predictions of network activity to enhance the user experience. 
     SUMMARY 
     This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. 
     Provided are computer implemented methods and systems for predicting network activity associated with a given network site. Using the methods or systems described herein, a service provider or an enterprise can selectively investigate and/or monitor a network site based on a probability that the network site will be involved in a specific network activity in the future. 
     The service provider or enterprise can send a request to the system for predicting a network activity with a network site. The system for predicting network activity can retrieve historical data related to the activity of the network site and analyze the historical data for signs of past network activities. Based on the analysis, a probability of future network site participation in the network activity can be determined. 
     In some embodiments, the probability is further determined based on certain environmental parameters (for example, a name of a domain associated with the network site, a malware risk associated with the network site, a general speed of network traffic, related network sites, and so forth). 
     To confirm the probability, activities of the network site can be monitored during a specific time period. If the monitoring results in evidence of the network activity, the network activity is confirmed. Furthermore, the calculated probability can be reevaluated and refreshed based on the received evidence. 
     If the probability of a network activity occurring exceeds a predefined threshold, actions ranging from notifying the service provider or enterprise to blocking, redirecting or providing interstitial activities relating to the network site can be taken. In some embodiments, the performed action depends on the value of the probability of the network activity. 
     The resulting data, which can include a domain name of the network site, a time range of the historical analysis and/or monitoring, the probability value, the network action associated with the network site, confirmation of the network activity, and so forth, can be graphically presented to a user on a graphical user interface or presented as a report, sent via e-mail, provided for downloading, and so forth. 
     In further exemplary embodiments, modules, subsystems, or devices can be adapted to perform the recited steps. Other features and exemplary embodiments are described below. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Embodiments are illustrated by way of example and not limitation in the figures of the accompanying drawings, in which like references indicate similar elements. 
         FIG. 1  is a block diagram showing an environment within which methods and systems for predicting network activities associated with a given network site can be implemented. 
         FIG. 2  is a block diagram showing various modules of the system for predicting network activities associated with a given network site. 
         FIG. 3  is a flow chart illustrating a method for predicting network activities associated with a given network site. 
         FIG. 4  is an example representation of network activity attributes. 
         FIG. 5  shows a diagrammatic representation of a computing device for a machine in the exemplary electronic form of a computer system, within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein, can be executed. 
     
    
    
     DETAILED DESCRIPTION 
     Network operators or enterprises can employ a variety of tools to manage and react to network activity, which can range from a malicious activity, such as spamming, to a Distributed Denial of Service (DDoS) attacks, misdirected queries, and actions of misconfiguration, such as traffic shaping, traffic redirection, interstitial activity, file downloading, association with further network sites, synchronization time with the further network sites, and so forth. A network activity can be associated with one or more domain names. Domain names are used to operate malicious networks (for example, bonnet). Conventional methods of tracking network activity have proved inefficient because of the quantity of existing domains. 
     Provided are methods and systems for predicting network activities associated with a network site based on historical data associated with a domain name of the network site. 
     The following detailed description includes references to the accompanying drawings, which form a part of the detailed description. The drawings show illustrations in accordance with exemplary embodiments. These exemplary embodiments, which are also referred to herein as “examples,” are described in enough detail to enable those skilled in the art to practice the present subject matter. The embodiments can be combined, and other embodiments can be formed, by introducing structural and logical changes without departing from the scope of what is claimed. The following detailed description is, therefore, not to be taken in a limiting sense and the scope is defined by the appended claims and their equivalents. 
     In this document, the terms “a” or “an” are used, as is common in patent documents, to include one or more than one. In this document, the term “or” is used to refer to a nonexclusive “or,” such that “A or B” includes “A but not B,” “B but not A,” and “A and B,” unless otherwise indicated. Furthermore, all publications, patents, and patent documents referred to in this document are incorporated by reference herein in their entirety, as though individually incorporated by reference. In the event of inconsistent usages between this document and those documents so incorporated by reference, the usage in the incorporated reference(s) should be considered supplementary to that of this document; for irreconcilable inconsistencies, the usage in this document controls. 
       FIG. 1  is a block diagram of various components of an environment  100  within which the methods and systems for predicting network activity associated with a network site may be implemented, in accordance with various embodiments. The environment  100  shows a system  200  for predicting a network activity. The system  200  can be used to detect network sites associated with network activity based on historical data of such network sites. An interested party  120 , for example, a service provider or an enterprise, can send a request  130  to the system  200  in order to determine a probability that a network site  140  is involved in network activity in future. The network activity can include misdirected queries and malicious activity, such as spamming, identity theft, a DDoS attack, a Domain Name Service (DNS) Amplification DDoS attack, a subdomain DDoS attack, and actions of misconfiguration, such as traffic redirection, interstitial activity, file downloading, association with further network sites, synchronization time with the further network sites, and so forth. 
     The network site  140  resides and acts in a network  110 . The network  110  may include the Internet or any other network capable of communicating data between devices. Suitable networks may include or interface with any one or more of, for instance, a local intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network), a MAN (Metropolitan Area Network), a virtual private network (VPN), a storage area network (SAN), a frame relay connection, an Advanced Intelligent Network (AIN) connection, a synchronous optical network (SONET) connection, a digital T1, T3, E1 or E3 line, Digital Data Service (DDS) connection, DSL (Digital Subscriber Line) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial-up port such as a V.90, V.34 or V.34bis analog modem connection, a cable modem, an ATM (Asynchronous Transfer Mode) connection, or an FDDI (Fiber Distributed Data Interface) or CDDI (Copper Distributed Data Interface) connection. Furthermore, communications may also include links to any of a variety of wireless networks, including WAP (Wireless Application Protocol), GPRS (General Packet Radio Service), GSM (Global System for Mobile Communication), CDMA (Code Division Multiple Access) or TDMA (Time Division Multiple Access), cellular phone networks, GPS (Global Positioning System), CDPD (cellular digital packet data), RIM (Research in Motion, Limited) duplex paging network, Bluetooth radio, an IEEE 802.11-based radio frequency network, or a worldwide interoperability for microwave access (WiMAX) network. The network  110  can further include or interface with any one or more of an RS-232 serial connection, an IEEE-1394 (Firewire) connection, a Fiber Channel connection, an IrDA (infrared) port, a SCSI (Small Computer Systems Interface) connection, a Universal Serial Bus (USB) connection or other wired or wireless, digital or analog interface or connection, mesh or Digi® networking. The network  110  may include any suitable number and type of devices (e.g., routers and switches) for forwarding commands, content, and/or web object requests from each client to the online community application and responses back to the clients. 
     The system  200  obtains and analyzes historical data associated with the network site  140  (for example, activity related to the network site  140 ). The purpose of the analysis is to determine the probability of the network activity for the network site  140  in future. If the probability exceeds a predetermined threshold, further actions can be performed by the system  200 . In some embodiments, the system  200  sends a report  150  on the probability of network activity associated with the network site  140  to the interested party  120 . 
       FIG. 2  is a block diagram of the system  200  for predicting network activity associated with a network site. Alternative embodiments of the system  200  may include more, fewer, or functionally equivalent modules. In some exemplary embodiments, the system  200  includes a communication module  210 , an analyzing engine  220 , a monitoring module  230 , a comparing module  240 , a reporting module  250 , and a real-time data aggregator  260 . It will be appreciated by one of ordinary skill that examples of the foregoing modules may be virtual and when instructions are said to be executed by a module they may, in fact, be retrieved and executed by a processor. The foregoing modules may also include memory cards, servers, and/or computer discs. Although various modules may be configured to perform some or all of the various steps described herein, fewer or more modules may be provided and still fall within the scope of various embodiments. 
     The communication module  210  can be configurable to provide a communication channel between the system  200  and various components of the environment  100 , including but not limited to, the interested party  120 , network  110 , and a network site  140 . Additionally, the communication module  210  may enable direct exchange of information between various modules of the system  200 . 
     The analyzing engine  220  is used for analyzing historical data, logs, messages, logins, and timing to detect signs of network activity and/or associated events. The findings are used to determine the likelihood of the site being employed for network actions. For example, it may be determined that the probability of the network activity associated with the network site is 60%. 
     The monitoring module  230  can be configurable to monitor the network site and its activity during a specific time range. The time range can be specified by the interested party, automatically determined by the system  200 , or dynamically adjusted according to the findings of the monitoring. Thus, the monitoring module  230  can ascertain an evidence of the network activity and give a confirmation of the network activity. Furthermore, the monitoring module  230  can adjust treatment of the network site. 
     The comparing module  240  can compare the determined probability to a predetermined threshold probability. If the determined probability is equal to or exceeds a predetermined threshold probability, the reporting module  250  can report the probability, warn an interested party and/or an operator, perform a further investigation of the network site, block the network site, redirect network traffic associated with the network site, and so forth. The reporting module  250  can report substantially real-time network traffic data to the real-time data aggregator  260 . 
       FIG. 3  illustrates a flow chart of a method  300  for predicting probability of network activity associated with a network site, in accordance with various embodiments. The method  300  may be performed by processing logic that may comprise hardware (e.g., dedicated logic, programmable logic, microcode, etc.), software (such as run on a general-purpose computer system or a dedicated machine), or a combination of both. In one exemplary embodiment, the processing logic resides at one or more processors, as illustrated in  FIG. 5 . 
     The method  300  may commence at operation  310  with the communication module receiving a request from the interested party, such as a service provider or an enterprise. The request can be associated with a specific network site. At operation  320 , historical data associated with the network site can be obtained and analyzed. The historical data can include information about one or more past network activities, or known network actions associated with the network site. If the analysis reveals signs of network activity, the findings are analyzed to determine the probability of network activity in which the network site is involved, at operation  330 . For example, it can be determined that the probability is 30%, 50%, 80%, and so forth. 
     Optionally, the method can continue with operation  340 . To avoid false positive determination of a network site as a source of network activity, the monitoring module can monitor the network site for a predefined period of time at operation  340 . For example, a spam mitigation solution may accidentally block legitimate email traffic. There are a variety of measures that may be taken within the system  200  to confirm the determined probability. If there is a possibility that the network site has some legitimate purpose, no action will be taken but the site will instead be monitored until the level of certainty approaches a predetermined level. 
     Thus, the monitoring module can monitor requests, messages, logins, and other network activities related to the network site, as well as misdirected queries to the network site. During the monitoring, one or more evidences associated with the network activity can be ascertained at operation  350 . The evidences can include specific actions performed on behalf of the network site in specific time, and so forth. In some embodiments, the probability determined at operation  330  can be reevaluated based on the evidence. Additionally, once the evidences are ascertained, a treatment of the network site can be adjusted at operation  360 . 
     In some embodiments, further factors, such as environmental parameters, can be considered to adjust the probability. The environmental parameters can include one or more of the following: a name of a domain associated with the network site, an association with a further network site, a correlation between the network site and the further network site, a malware risk associated with the network site, an activity associated with the network site, a general security state, related network sites, and a speed of network traffic. 
     At operation  370 , the probability can be compared to a predetermined threshold probability. For example, the predetermined threshold probability can be set to 50%. If the determined and/or reevaluated probability exceeds the predetermined threshold probability, an action can be taken at operation  380 . The action includes one or more of the following: reporting the probability, warning the interested party, performing a further investigation of the network site, blocking the network site, redirecting network traffic associated with the network site, and so forth. The action to take can be selected based on the probability value. For example, the specific actions can be associated with certain probability values. In some example embodiments, if the probability is determined to be 80%, the network site is blocked, while a probability determined to be 60% triggers a warning to the interested party. 
     In some embodiments, the probability is reported by providing a graphic representation of attributes associated with the network activity. For example, the attributes can be displayed via a graphical user interface of the system  200 . In further embodiments, the probability can be reported by presenting a report to an interested party. The report can be sent via e-mail, provided for downloading, and so forth. 
     An example representation  400  of network activity attributes  410  is shown in  FIG. 4 . The graphical representation of network activity attributes  410  can include a domain name  412  of the network site for which the probability is determined, a time range  414  for monitoring the network site, and the determined probability  416  of the network activity type  418  associated with the network site. Additionally, the representation  400  can show a network activity type  418  associated with the network site (for example, misdirected queries and malicious activity, such as spamming, DDoS attack, DNS Amplification DDoS attack, a subdomain DDoS attack, and actions of misconfiguration, such as traffic redirection, interstitial activity, traffic shaping, file downloading, association with further network sites, synchronization time with the further network sites, and so forth). Furthermore, the representation  400  can include a confirmation  420  that the network site has taken part in the network activity and evidence  422  obtained as a result of monitoring the network site and confirming the network activity. In various embodiments, the representation  400  can include additional attributes or show a reduced list of attributes. 
       FIG. 5  illustrates an exemplary computing system  500  (also referred to herein as computer system  500 ) that may be used to implement an embodiment of the present disclosure. Computer system  500  of  FIG. 5  may be implemented in the context of network devices and the like. The computing system  500  of  FIG. 5  includes one or more processors  510  and main memory  520 . Main memory  520  stores, in part, instructions and data for execution by processor  510 . Main memory  520  can store the executable code when the computing system  500  is in operation. The computing system  500  of  FIG. 5  may further include a mass storage device  530 , portable storage medium drive(s)  540 , output devices  550 , user input devices  560 , a display system  570 , and other peripheral devices  580  (also referred to herein as peripheral(s)  580 ). 
     The components shown in  FIG. 5  are depicted as being connected via a single bus  590 . The components may be connected through one or more data transport means. Processor  510  and main memory  520  may be connected via a local microprocessor bus, and the mass storage device  530 , peripheral device(s)  580 , portable storage medium drive  540 , and display system  570  may be connected via one or more input/output (I/O) buses. 
     Mass storage device  530 , which may be implemented with a magnetic disk drive or an optical disk drive, is a non-volatile storage device for storing data and instructions for use by processor  510 . Mass storage device  530  can store the system software for implementing embodiments of the disclosed technology for purposes of loading that software into main memory  520 . 
     Portable storage medium drive  540  operates in conjunction with a portable non-volatile storage medium, such as a floppy disk, compact disk (CD), or digital video disc (DVD), to input and output data and code to and from the computer system  500  of  FIG. 5 . The system software for implementing embodiments of the present disclosure may be stored on such a portable medium and input to the computer system  500  via the portable storage medium drive  540 . 
     Input devices  560  provide a portion of a user interface. Input devices  560  may include an alphanumeric keypad, such as a keyboard, for inputting alphanumeric and other information, or a pointing device, such as a mouse, trackball, stylus, or cursor direction keys. Additionally, the computing system  500  as shown in  FIG. 5  includes output devices  550 . Suitable output devices include speakers, printers, network interfaces, and monitors. 
     Display system  570  may include a liquid crystal display (LCD) or other suitable display device. Display system  570  receives textual and graphical information and processes the information for output to the display device. 
     Peripheral device(s)  580  may include any type of computer support device to add additional functionality to the computer system. Peripheral device(s)  580  may include a modem or a router. 
     The components contained in the computer system  500  of  FIG. 5  are those typically found in computer systems that may be suitable for use with embodiments of the disclosed technology and are intended to represent a broad category of such computer components that are well known in the art. Thus, the computer system  500  of  FIG. 5  can be a PC, hand held computing device, telephone, mobile computing device, workstation, server, minicomputer, mainframe computer, or any other computing device. The computer can also include different bus configurations, networked platforms, multi-processor platforms, and so forth. Various operating systems (OSs) can be used, including UNIX, Linux, Windows, Macintosh OS, Palm OS, Android, and other suitable operating systems. 
     Some of the above-described functions may be composed of instructions that are stored on storage media (e.g., a computer-readable medium). The instructions may be retrieved and executed by the processor. Some examples of storage media are memory devices, tapes, disks, and the like. The instructions are operational when executed by the processor to direct the processor to operate in accord with the disclosed technology. Those skilled in the art are familiar with instructions, processor(s), and storage media. 
     It is noteworthy that any hardware platform suitable for performing the processing described herein is suitable for use with the disclosed technology. The terms “computer-readable storage medium” and “computer-readable storage media” as used herein refer to any medium or media that participate in providing instructions to a Central Processing Unit (CPU) for execution. Such media can take many forms, including, but not limited to, non-volatile media, volatile media and transmission media. Non-volatile media include, for example, optical or magnetic disks, such as a fixed disk. Volatile media include dynamic memory, such as system Random Access Memory (RAM). Transmission media include coaxial cables, copper wire and fiber optics, among others, including the wires that comprise one embodiment of a bus. Transmission media can also take the form of acoustic or light waves, such as those generated during radio frequency (RF) and infrared (IR) data communications. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, a hard disk, magnetic tape, any other magnetic medium, a CD-ROM disk, DVD, any other optical medium, any other physical medium with patterns of marks or holes, a RAM, a PROM, an EPROM, an EEPROM, a FLASHEPROM, any other memory chip or cartridge, a carrier wave, or any other medium from which a computer can read. 
     Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to a CPU for execution. A bus carries the data to system RAM, from which a CPU retrieves and executes the instructions. The instructions received by system RAM can optionally be stored on a fixed disk either before or after execution by a CPU. 
     The above description is illustrative and not restrictive. Many variations of the invention will become apparent to those of skill in the art upon review of this disclosure. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the appended claims along with their full scope of equivalents. While the present invention has been described in connection with a series of embodiments, these descriptions are not intended to limit the scope of the invention to the particular forms set forth herein. It will be further understood that the methods of the invention are not necessarily limited to the discrete steps or the order of the steps described. To the contrary, the present descriptions are intended to cover such alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims and otherwise appreciated by one of ordinary skill in the art. 
     One skilled in the art will recognize that the Internet service may be configured to provide Internet access to one or more computing devices that are coupled to the Internet service, and that the computing devices may include one or more processors, buses, memory devices, display devices, input/output devices, and the like. Furthermore, those skilled in the art may appreciate that the Internet service may be coupled to one or more databases, repositories, servers, and the like, which may be utilized in order to implement any of the embodiments of the disclosure as described herein. 
     While specific embodiments of, and examples for, the system are described above for illustrative purposes, various equivalent modifications are possible within the scope of the system, as those skilled in the relevant art will recognize. For example, while processes or steps are presented in a given order, alternative embodiments may perform routines having steps in a different order, and some processes or steps may be deleted, moved, added, subdivided, combined, and/or modified to provide alternative or subcombinations. Each of these processes or steps may be implemented in a variety of different ways. Also, while processes or steps are at times shown as being performed in series, these processes or steps may instead be performed in parallel, or may be performed at different times. 
     From the foregoing, it will be appreciated that specific embodiments of the system have been described herein for purposes of illustration, but that various modifications may be made without deviating from the spirit and scope of the system. Accordingly, the system is not limited except as by the appended claims.