Patent Publication Number: US-8996669-B2

Title: Internet improvement platform with learning module

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates generally to improving Internet service traffic, and more particularly to discriminating among DNS (Domain Name System) requests and service requests upon redirecting DNS requests from various sources based on interaction history, adaptive learning, user experiences and global DNS data. 
     2. Description of Related Art 
     Since the Internet was launched in 1995, online services have emerged for many consumer and business needs and applications. The power of the Internet has been attributed to its unique properties as a global, two-way medium that allows any user the ability to reach global users or businesses and interact with them, literally at the speed of light. The term “globalization” has become the new order of the economic day, powerfully enabled by the Internet, which has caused massive shifts and transformations in how consumers and businesses conduct their day-to-day personal and commercial business. 
     In today&#39;s “information age” people frequently perform various types of activities using computing devices connected to the Internet. The Internet has made searching for information simple, speedy and efficient. To perform a computerized search, a searcher simply enters a word or words (termed “keywords”) into a website query box in order to find information related to the entered words. 
     Using the Internet to explore available services, reach destinations, share and publish content with friends, and connecting and communicating personally and professionally has become so ubiquitous that Internet use is really no longer only about searching. Individuals today actually want to connect directly with services that are suited to their needs. Users may click on one or more links from a list that appears after a search using keywords or in an article that they are reading without going to a search engine. Users may also type website names, or single word terms, into a browser directly to reach an intended destination, or they might simply click on links presented on some other pages for this purpose. Some of these links, search results and other mechanisms may lead individual users to useful and intended content. Some may lead the user to unintended and harmful content. 
     When entering the addresses directly into the browser, users may misspell names or terms, or they may enter names of non-existent domains. Users may also inadvertently enter queries for addresses that may be harmful to the user or the user&#39;s system, account or identity. 
     There is a need for an Internet improvement platform that intermediates these requests and allows, at a network level, to redirect queries for erroneous or malicious sites to other sites that may be more appropriate. 
     SUMMARY OF THE INVENTION 
     Various embodiments of the present invention disclose systems and methods for an Internet platform that improves the user&#39;s Internet experience. More specifically, embodiments relating to directing and filtering Domain Name System (DNS) server traffic are disclosed. 
     The various embodiments of the systems and methods of directing DNS traffic include receiving at an Internet improvement platform a DNS query issued from an Internet application running on a computing device. The Internet improvement platform then formulates an appropriate response. The response may include redirection of the query, a refusal to serve the request, or simply no response. 
     Separate modules within the Internet improvement platform may formulate a response for requests directed respectively to non-existent domains, malicious domains, and for requests from designated sources. 
     The system executes the response and records data relative both to the query received and the response after the request is served. 
     A learning module included in the Internet improvement platform provides the system with the capacity to learn from the various events as well as the data collected or observed. By monitoring the characteristics of the received queries, and by further monitoring responses to served requests, the system may improve its rule set over time. That is, the system is able to learn from and utilize global Internet events and occurrences to improve its ability to determine the most appropriate response. 
     A mechanism may be included with served requests, so that the system can detect whether or not the source of the query downloaded the proffered page. The presence or absence of various download factors is recorded and used by the learning module to influence future decisions as to an appropriate response to a query. It can be any mechanism suited to indicating use of an indicated page. 
     The learning module works in conjunction with the intelligent DNS platform and other modules included in the Internet improvement platform to improve a user&#39;s Internet experience. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a schematic of an exemplary system for directing DNS server traffic. 
         FIG. 2  is a schematic illustrating an exemplary architecture according to the present invention. 
         FIG. 3  is a flowchart of an exemplary method for directing DNS server traffic. 
         FIG. 4  is a flowchart of an exemplary mode of operation of the Internet improvement platform including the learning module. 
         FIG. 5  illustrates an exemplary computing system that may be used to implement embodiments according to the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     Various embodiments of the present invention relate to systems and methods for directing Internet navigation, including redirecting and/or filtering DNS server traffic. As mentioned above, users sometimes mistype or misspell the names of websites or enter terms directly into the browser, or click on links that point to such misspelled names. Sometimes users enter or click on links pointing to names of websites that do not exist. This can be done unintentionally or intentionally. Additionally, bots, spiders, or other malware might be implemented with malicious intent. Embodiments according to the present invention address these and other problems. 
       FIG. 1  is a schematic of an exemplary system  100  for Internet improvement. A source  105  is communicatively coupled with a network  110 , the Internet  115 , or a network cloud  150 . The source  105  may be a legitimate user using a network browser application, a bot, a spider, various forms of malware, automated programs, faulty applications, or mis-programmed or mis-configured network devices etc. The network  110  may be, for example, an enterprise, public or private network. The Internet  115  may be, for example, an Internet service provider (ISP), wireless broadband provider, carrier or cable provider or other communications network. The Network Cloud  150  may be, for example, a direct network connection with the Internet improvement system. For purposes of this patent, the definition of Internet service provider will include any technology that provides a connection with the Internet. Examples of such technologies include, but are not limited to, traditional Internet service providers, telecommunications companies, and any other provider of access to Internet services. 
     The network  110 , the Internet  115 , and the network cloud  150  are independently or collectively communicatively coupled with an intelligent DNS platform  120 . The Intelligent DNS platform  120  is a DNS server that allows reporting and logging of various DNS events and interactions with one or more service policy modules which may include, for example, software or systems for Non-Existent Domain Redirection  125 , Malicious Domain Redirection  130  and/or User Access Redirection  135 . The Intelligent DNS platform  120  may be communicatively coupled with the service policy modules. The Intelligent DNS platform  120  operates in conjunction with a learning module  235  described in further detail following. 
     The Nonexistent Domain Redirection module  125  may enable a Web error redirection service that helps users reach their intended destinations using standard search results or other navigation techniques as the destination verification mechanism. The Nonexistent Domain Redirection module  125  may be controlled by the provider of the network  110 . 
     The Nonexistent Domain Redirection module  125  facilitates domain redirection (via the network  110 , the Internet  115  or the network cloud  150 ). When a user enters or clicks on a link with website information in a web browser application, the user might mistype or misspell a website or domain name, or the link may point to a misspelled domain name. Per the DNS protocol, a query for a nonexistent domain returns an NXDOMAIN error response (e.g. “Server not found”). Upon a DNS query resulting in an NXDOMAIN, the Nonexistent Domain Redirection module  125  redirects qualified non-existent names that may include user typed or clicked names, to a carrier-branded portal with industry standard search results. Search results on this page enhance the user&#39;s Web experience by showing, for example, links to various destinations within the relevant query parameters entered by the user. Relevant and thoughtfully presented search results on this page not only enhance the user&#39;s experience, but may facilitate the carrier monetizing clicks that generate revenue. The Intelligent DNS Platform  120  and the Nonexistent Domain Redirection module  125  incorporates data about user interaction with these search results from the learning module  235  in order to intelligently examine DNS requests. 
     In one embodiment, the Nonexistent Domain Redirection module  125  is a carrier-configurable and customizable domain name filter that determines which NXDOMAIN traffic is redirected. The Malicious Domain Redirection module  130  may be controlled by the Internet Service Provider. The Malicious Domain Redirection module  130  facilitates malicious or otherwise harmful domain redirection. The Malicious Domain Redirection module  130  protects Internet users from Web-based malware, harmful sites, and threats such as bots, worms, viruses, and phishing sites. The Intelligent DNS Platform  120  and the Malicious Domain Redirection module  130  incorporate data about malicious websites from the learning module  235  in order to intelligently examine DNS requests. 
     Upon the identification of a user request to access a malicious site, the Malicious Domain Redirection module  130  may redirect the user to a teaching page that gives information about the threat(s). The teaching page may also provide other information, such as, for example, additional services that might be available. The Malicious Domain Redirection module  130  may provide protection against a variety of Internet threats, including but not limited to phishing, etc. 
     The Malicious Domain Redirection module  130  may also be used to block access to certain content. For example, the Malicious Domain Redirection module  130  may be used to block sites related to child exploitation, etc. It is contemplated that the Malicious Domain Redirection module  130  may be used to block access of any content or type of content to any audience or type of audience desired. For example, the Malicious Domain Redirection module  130  might restrict access of some content for certain demographics such as children. 
     The User Access Redirection module  135  may be controlled by the provider of the network  110 . The User Access Redirection module  135  facilitates user quarantine applications. The User Access Redirection module  135  redirects a user or other entity for which a determination has been made that the user or entity should not be serviced, has an infected device or should be redirected to a specified Internet service. For example, the User Access Redirection module  135  may redirect a user to a landing page that invites the user to enter his credit card information to renew his subscription to the service provided by, for example, the provider of an Internet improvement platform  155 . 
     A navigation assistant module  140  and a security assistant module  145  are communicatively coupled with the Intelligent DNS platform and the service policy modules which are hosted or resident in a network  110 , the Internet  115 , and a network cloud  150 . 
     The navigation assistant module  140  is configured to provide a user with navigation assistance using industry standard search results to verify the users intended destination. A user may be provided with a first Internet service, such as a first landing page, after the user mistypes or misspells a domain name within an address window of a network browser application. Alternative pages or sites may be suggested based on aggregate search results. The user can also be redirected to the intended page or a possible page of interest (or a second Internet service). 
     The security assistant module  145  is configured to provide protection from malware, bot sites, phishing sites, and the undesirable occurrences that might be caused thereby. The security assistant module  145  does more than simply aggregate diverse sets of “black lists.” The security assistant module  145  may adapt to real-time traffic patterns that may indicate potential threats, thus protecting vital network resources. 
     The Internet improvement platform  155  may comprise the navigation assistant module  140 , the security assistant module  145 , the intelligent DNS platform  120 , the nonexistent domain redirection module  125 , the malicious domain redirection module  130 , and the user access redirection module  135 . In all embodiments, the Internet improvement platform  155  may include the learning module  235 . 
     In various embodiments, a source (such as a user) enters a mistyped, misspelled, or otherwise non-existent domain name into a browser. The nonexistent domain redirection module  125  receives the DNS request representing the domain name and, rather than returning a message that the page does not exist, returns a DNS navigation assistant module  140  internet protocol (IP) address (IP address of a navigation assistant module  140  server) to the browser of the user. The user may then be redirected by the navigation assistant module  140  to a search page. The search page may include advertisements, etc. The search page may also include links to advertisements, businesses, or any other suitable link(s) or items. In one exemplary embodiment, a load balancer  220  is communicatively coupled between the user and the navigation assistant module  140 . The load balancer  220  may only allow a certain protocol (e.g. http) through to the navigation assistant module  140 , for instance. 
     At other times, the source may be a user, bot, etc. that sends a request for access to a malicious domain. For example, the source may attempt to access a phishing site or some other undesirable or illegal website. The malicious domain redirection module  130  may block access to the site and/or redirect a user to an Internet service or page, such as a warning page. 
     The source  105  may be, for example, a user that system administrators have deemed should not be serviced for any of a variety of reasons. The user access redirection module  135  may, for example, block access and/or redirect the user to an Internet service or page, such as a page informing the user that he has been denied access to the site he was trying to access until his account is brought current. 
     It is noteworthy that oftentimes what arrives at the intelligent DNS platform  120  includes queries from bots, spiders, or other malware as mentioned above. The requesting party may or may not have malicious intent. In some instances the user&#39;s computer is infected with malware without knowledge on the part of the user. These and other problems are dealt with by the Internet improvement platform  155 . 
     A large percentage of the traffic through the Intelligent DNS platform  120  might normally be generated by non-users (e.g. malware, bots, spiders, etc.). This type of traffic typically will not generate qualified redirects. A redirection module, such as the nonexistent domain redirection module  125 , is configured to work in conjunction with the navigation assistant module  140  to filter out most non-user NXRs (NXDOMAIN redirections) that will not generate a browser view. It is desirable to filter out non-user NXRs because non-user NXRs typically do not provide use experience to users. 
     An output of the nonexistent domain redirection module  125  may be an NXR sent to the navigation assistant module  140 . The nonexistent domain redirection module  125  may continue to send NXRs until a lack of real user response is detected. In one embodiment, a user response may be represented by an embedded follow-up signal. The follow-up signal may be downloaded by a user using a browser, which is an indication of a valid user. The follow-up signal not being downloaded may be an indication of a non-user such as a bot etc. 
     Various forms of follow-up signals are contemplated herein. For example the system could imbed a graphic image in the response to the user. The system may also implement a java script that sends out a follow-up signal (e.g. that a keystroke was identified) to the present system. In another embodiment, a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) could be implemented where a user is required to login in order to access a page. 
       FIG. 2  is a schematic illustrating an exemplary architecture  200  according to the present invention. A redirection cluster  205  may include the Intelligent DNS platform  120 , the nonexistent domain redirection module  125 , the malicious domain redirection module  130 , and the user access redirection module  135  of  FIG. 1 . The redirection cluster  205  receives a DNS request  210  initiated by a user  215 . As mentioned above, the load balancer  220  may be communicatively coupled between the user  215  and a redirection server  260 . The redirection server  260  may include a navigation assistant module  140  server and a filter. The navigation assistant module  140  server may be the navigation assistant module  140 , or may be a subset or superset thereof. The load balancer  220  might only allow a certain protocol (e.g. http) through to the navigation assistant module  140 , for instance, as mentioned above. 
     A query  225  that includes a request to download a view including at least one of the follow-up signals described above (sent to the redirection server  260 ) may be indicative of the presence of a real user  215  (human as opposed to a bot etc.). As mentioned previously, any suitable means of determining indicators of real users is contemplated. 
     Data  250  related to both the queries received and resultant responses, for example follow-up signals, may be output to a database of data logs  230 . The data logs  230  are communicatively coupled with the learning module  235 . The operation of the learning module  235  is described in further detail below. 
     The redirection server  260  receives an output  240  from the learning module  235 . The policies controlling the redirection server  260  use the input from the learning module  235  at data to aid in formulating an appropriate response to each query. A response recommendation  245  is transmitted from the learning module  235  to the redirection cluster  205 . The generation of the response recommendation  245  aids the policies within the redirection cluster  205  to efficiently filter out flagged IP addresses, undesirable users, bots, etc. 
       FIG. 3  is a flowchart  300  of an exemplary method for directing DNS server traffic. At step  305 , a DNS query issued from an Internet application running on a computer device is received at the Internet improvement platform  155  (e.g. at the nonexistent domain redirection module  125 ). For example, a user may enter a nonexistent domain name into a browser (Internet application) running on the user&#39;s computer. 
     At step  310 , it is determined at the Internet improvement platform  155  what an appropriate response to the DNS query will be. It should be noted that not serving the DNS query, i.e. no response, may be an appropriate response. For example, there may be instances in which the Internet improvement platform  155  forwards a request related to the DNS query to the Internet and receives back an NXDOMAIN message indicating that the given domain does not exist. Such an instance may occur when the user types in a domain name that does not exist. The user may misspell or mistype the domain name, or the domain name may no longer exist. In one embodiment, the nonexistent domain redirection module  125  receives the NXDOMAIN via the redirection cluster  205 . 
     The system  200  determines an appropriate response to each DNS query received. The type of response may be established by the operating policies of the system. The operating policies may be changed with each submitted query. The system  200  uses the data collected in the data logs  230  to formulate the appropriate response to a query. The formulated response may vary with time in light of data collected and considered by the system  200 . Data considered in formulating the appropriate response includes, but is not limited to, prior Internet Improvement Platform events, stored data relative to query parameters and prior response data, and end user interaction data. Data may be imported from other sources or third parties. 
     At step  315 , the response is executed in response to the DNS query. Executing the response may include redirecting the Internet application (e.g. browser etc.) to an Internet service. For example, the Internet improvement platform  155  may send an IP address to the user&#39;s browser. In one embodiment, the search IP address may be sent to the browser via one or more of the nonexistent domain redirection module  125 , the intelligent DNS platform  120 , and the network  110 . The user&#39;s computer may then connect to the search page. The Internet improvement platform  155  or the search page may then deliver a results page (e.g. including links to advertisements) to the user&#39;s browser. Thus, what would otherwise be “junk traffic” is now capable of generating revenue while maximizing customer satisfaction. 
     It is envisioned that various embodiments may allow system administrators or others to define multiple policy configurations applicable to one or more end users or websites. Policy configurations may vary based upon designated times, conditional triggers, or specific requests from users with administrative authority. 
     The evaluation process associated with the formulated response may be better understood with reference to the flowchart  400  of  FIG. 4 . When the system  200  receives a DNS request  210  with an erroneous domain name, the redirection cluster  205  may propose a redirection of the DNS request  210  with a substitute page request. The page request (resultant from the DNS request  210 ) may then be evaluated with input from the learning module  235  and the data logs  230 . Depending on the result of the evaluation process, the page request may or may not be returned to the user  215 . 
     The evaluation process begins with a step  405  in which the redirected page request is received from the redirection cluster  205  at the redirection server  260 . In a comparing step  410 , the page request is compared by the learning module  235  with the data logs  230 . The page request is checked against the data logs  230  to determine in a decision step  415  whether or not the request should be served or filtered. There may be multiple categories of criteria for filtering the page request. 
     One category of filtered requests may include pages that appear on a manual entry log in the data logs  230 . It is envisioned that the manual entry log may include those pages deemed to be not worthy of being served to the user  215  by an administrator of the system  200 . These pages may be known to be the results of queries initiated by non-real (non-human, such as bots, etc.) users  215 , malicious domains, etc. 
     Another category of page requests that are filtered may include pages determined by a learning process within the system  200 , e.g. in the learning module  235 . This category is populated by pages determined by the learning module  235  to not be candidates to be served to the user  215 . The learning module  235  may check the page request for certain pattern or trends that indicate the source of the request. For example, the same address requested fifty times in one minute is not a typographical error by a human user, but is far more likely to be a bot generated request. 
     Still another category of page requests that may not be served are those requests that the data logs  230  show to not be associated with any returned follow-up signals in spite of a high number of requests. The number of requests that triggers this filter is variable, and is determined by a system administrator, the learning algorithms or others. An important aspect of this set of filtering criteria in various embodiments is that the number of page requests served is never set to zero. This allows the system  200  to probe the page request from time to time, perhaps with a 0.1% frequency, to determine if any beneficial activity is detected. By filtering only a high percentage of the page requests, for instance 99.9%, the system is able to avoid erroneous filters. The percentage of requests served, although it may be a very low percentage, enables the system  200  to detect a valid request, and to reclassify the request accordingly. 
     Another category of page requests includes those requests that do not yet have a definitive history, but that have a history of at least some percentage of follow-up signals returns. These requests may be served, and the data from the serves collected to add to the data logs  230 . 
     Another category of page requests are those requests for which the system  200  has no record. If the page request does not appear in the data logs  230 , the request may be served, and the results of the serve may be recorded in the data logs  230 . 
     In a recording step  420 , the learning module  235  and the data logs  230  record the characteristics of each DNS request  210  received, and the result of any resultant served pages. The characteristics recorded may include the source of the page request, the number of identical requests, and the time frame in which the requests were made. The results that are recorded may include the number of times a follow-up signal is returned. The number of times a follow-up signal is returned is important, because a request  225  to download a view including a follow-up signal (sent to the redirection server  260 ) may be indicative of the presence of a real user  215  (again, a human as opposed to a bot, etc.). 
     As mentioned above, a follow-up signal can be any suitable means of determining indicators of real users, and all such determination means are contemplated herein. Data  250  related to, for example, follow-up signal downloads is output to the data logs  230 . 
     In various embodiments of the system  200 , the learning module  235  creates and maintains a categorization metric for each page served. The categorization metric may be probabilistic. For example, the requests for a given page may be determined by the categorization metric to be 20% from a real user and 80% from an automated program. The response of the Internet Improvement Platform to the request for the page may be dependent on the categorization metric. The page requests and the follow-up signals are all transmitted through the unreliable internet where packets can be dropped and false signals can be generated by hackers. The probabilistic model in the learning module is a way to counter the unreliability of the input to the Internet improvement platform. The categorization metric may be a composite score created and maintained for each page served. The composite score may be adjusted for each request depending on the follow-up signal for each viewed page. 
     A system administrator may use the composite score to determine which page requests will be served and which page requests will be filtered. A serve value composite score may be established. A page request with a composite score below the selected value may always be served. Similarly, a filter value composite score may be established. A page request with a composite score greater than the filter value may be served only a very low percentage of the time. As noted above, even page requests with very high composite scores will be served some finite percentage of the time in order to detect possible errors in characterization of the request. 
       FIG. 5  illustrates an exemplary computing system  500  that may be used to implement embodiments according to the present invention. The computing system  500  of  FIG. 5  includes one or more processors  510  and memory  520 . The main memory  520  stores, in part, instructions and data for execution by the processor  510 . The main memory  520  can store the executable code when the system  500  is in operation. The system  500  of  FIG. 5  may further include a mass storage device  530 , portable storage medium drive(s)  540 , output devices  550 , user input devices  560 , a graphics display  570 , and other peripheral devices  580 . 
     The components shown in  FIG. 5  are depicted as being connected via a single bus  590 . The components may be connected through one or more data transport means. The processor unit  510  and the main memory  520  may be connected via a local microprocessor bus, and the mass storage device  530 , peripheral device(s)  580 , portable storage device  540 , and display system  570  may be connected via one or more input/output (I/O) buses. 
     The mass storage device  530 , which may be implemented with a magnetic disk drive or an optical disk drive, is a non-volatile storage device for storing data and instructions for use by the processor unit  510 . The mass storage device  530  can store the system software for implementing embodiments of the present invention for purposes of loading that software into the main memory  520 . 
     The portable storage device  540  operates in conjunction with a portable non-volatile storage medium, such as a floppy disk, compact disk or Digital video disc, to input and output data and code to and from the computer system  500  of  FIG. 5 . The system software for implementing embodiments of the present invention may be stored on such a portable medium and input to the computer system  500  via the portable storage device  540 . 
     The input devices  560  provide a portion of a user interface. The input devices  560  may include an alpha-numeric keypad, such as a keyboard, for inputting alpha-numeric and other information, or a pointing device, such as a mouse, a trackball, stylus, or cursor direction keys. Additionally, the system  500  as shown in  FIG. 5  includes output devices  550 . Suitable output devices include speakers, printers, network interfaces, and monitors. 
     The display system  570  may include a liquid crystal display (LCD) or other suitable display device. The display system  570  receives textual and graphical information, and processes the information for output to the display device. 
     The peripherals  580  may include any type of computer support device to add additional functionality to the computer system. The peripheral device(s)  580  may include a modem or a router. 
     The components contained in the computer system  500  of  FIG. 5  are those typically found in computer systems that may be suitable for use with embodiments of the present invention and are intended to represent a broad category of such computer components that are well known in the art. Thus, the computer system  500  of  FIG. 5  can be a personal computer, hand held computing device, telephone, mobile computing device, workstation, server, minicomputer, mainframe computer, or any other computing device. The computer can also include different bus configurations, networked platforms, servers, multi-processor platforms, etc. Various operating systems can be used including UNIX, Linux, Windows, Macintosh OS, Palm OS, and other suitable operating systems. 
     Modules and other blocks or elements disclosed herein can be stored as software, firmware, hardware, as a combination, or in various other ways. It is contemplated that various modules can be removed or included in other suitable locations besides those locations specifically disclosed herein. In various embodiments, additional modules, blocks, or elements can be included in the exemplary system described herein. 
     The embodiments described herein are illustrative of the present invention. As these embodiments of the present invention are described with reference to illustrations, various modifications or adaptations of the methods and or specific structures described may become apparent to those skilled in the art in light of the descriptions and illustrations herein. All such modifications, adaptations, or variations that rely upon the teachings of the present invention, and through which these teachings have advanced the art, are considered to be within the spirit and scope of the present invention. Hence, these descriptions and drawings should not be considered in a limiting sense, as it is understood that the present invention is in no way limited to only the embodiments illustrated.