Granted Patent B1

US 9,426,049 · App. 14/148,528 · Granted Aug 23, 2016

Abstract

Claims (34)

1. A computerized method for inferring a domain for an IP address, the method performed using at least one processor, the method comprising:

receiving, by the at least one processor, a computerized flow record from a communication service provider including the IP address, wherein the IP address corresponds to a request from a subscriber for an Internet resource;

performing, by the at least one processor, an in-stream lookup comprising:

determining, by the at least one processor, whether any secure socket layer (“SSL”) exchanges result from the request for the Internet resource;

when the SSL exchanges exist, attempting to retrieve domain information corresponding to the IP address from the SSL exchanges;

determining, by the at least one processor, whether any domain name system (“DNS”) records exist that include the IP address; and

when the DNS records exist that include the IP address, attempting to retrieve the domain information corresponding to the IP address from the DNS records;

performing, by the at least one processor, contextual mapping comprising:

performing a whois query using the IP address in an attempt to identify the domain information corresponding to the IP address;

performing a reverse DNS lookup in an attempt to identify the domain information corresponding to the IP address;

attempting to establish an SSL connection to the IP address to identify the domain information; and

querying clickstream information from the content service provider in an attempt to identify the domain information; and

performing, by the at least one processor, a learning process to populate a database used while performing contextual mapping, the learning process comprising at least one of:

performing deep packet inspection to obtain DNS queries and response logs;

capturing network traffic within a network to trace domain resolutions within the network;

attempting to access a webpage associated with the IP address; and

analyzing clickstream data.

2. The computerized method of claim 1 wherein the Internet resource is a webpage.

3. The computerized method of claim 1 wherein performing contextual mapping further includes analyzing a user transaction history in an attempt to identify the domain information.

4. The computerized method of claim 3 , wherein the user transaction history includes at least one of:

a historical record of all domains associated with the IP address, regardless of the user that requested the IP address; and

a historical record of all domains associated with the IP address in response to a request for the IP address from the subscriber.

5. The computerized method of claim 1 wherein querying the clickstream information further includes querying a database of clickstream information.

6. The computerized method of claim 4 wherein the method further comprises building the database of clickstream information by analyzing deep packet inspection (“DPI”) logs and domain name system (“DNS”) lookup records.

7. The computerized method of claim 1 further comprising performing, by the at least one processor when the domain information was successfully retrieved, associative mapping comprising:

determining, by the at least one processor, whether the domain information corresponds to a user-perceived domain; and

when the domain information is not a user-perceived domain, determining a corresponding domain that is a user-perceived domain.

8. The computerized method of claim 1 further comprising updating the database, the updating comprising:

using DNS queries and response logs obtained during the contextual mapping process to update the database;

using domain resolutions traced during the contextual mapping process to update the database;

using web pages accessed during the contextual mapping process to update the database; and

using clickstream data analyzed during the contextual mapping process to update the database.

9. The computerized method of claim 1 further comprising generating an enriched record including the IP address and the domain information.

10. The computerized method of claim 1 further comprising determining an application that the subscriber used to request the Internet resource.

Assignments (9)