Domain name and internet address approved and disapproved membership interface

1. A method for domain name and Internet Protocol (IP) address approved and disapproved membership inference, the method comprising:

receiving a plurality of domain names and a plurality of IP addresses;

determining a mapping of the received plurality of domain names to the received plurality of IP addresses;

identifying domain names from the received plurality of domain names that belong to an approved domain name list or to a disapproved domain name list;

identifying IP addresses from the received plurality of IP addresses that belong to an approved IP address list or to a disapproved IP address list;

for an unknown IP address from the received plurality of IP addresses and domain names that map to the unknown IP address, determining, by at least one processor, if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list;

in response to a determination that more than the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designating the unknown IP address as approved and assigning the unknown IP address to the approved IP address list; and

in response to a determination that less than or equal to the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designating the unknown IP address as disapproved and assigning the unknown IP address to the disapproved IP address list.

2. The method of claim 1 , further comprising:

for an unknown domain name from the received plurality of domain names and IP addresses that map to the unknown domain name, determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list;

in response to a determination that more than the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designating the unknown domain name as approved and assigning the unknown domain name to the approved domain name list; and

in response to a determination that less than or equal to the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designating the unknown domain name as disapproved and assigning the unknown domain name to the disapproved domain name list.

3. The method of claim 1 , further comprising:

assigning a confidence interval to the designation of the unknown IP address as approved or disapproved;

determining if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designating the unknown IP address as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designating the unknown IP address as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list.

4. The method of claim 2 , further comprising:

assigning a confidence interval to the designation of the unknown domain name as approved or disapproved;

determining if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designating the unknown domain name as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designating the unknown domain name as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list.

5. The method of claim 1 , wherein determining if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list further comprises:

computing an adjusted fraction related to the domain names that map to the unknown IP address by:

accounting for a total number of the received plurality of domain names, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

comparing the computed adjusted fraction to a threshold to determine whether the unknown IP address is designated as approved or as disapproved.

6. The method of claim 2 , wherein determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list further comprises:

computing an adjusted fraction related to the IP addresses that map to the unknown domain name by:

accounting for a total number of the received plurality of IP addresses, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

comparing the computed adjusted fraction to a threshold to determine whether the unknown domain name is designated as approved or as disapproved.

7. The method of claim 1 , further comprising:

marking a time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses;

determining if the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds a predetermined time interval based on a current time;

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds the predetermined time interval based on the current time, updating the mapping of the received plurality of domain names to the received plurality of IP addresses; and

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses is less than or equal to the predetermined time interval based on the current time, waiting for the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses to exceed the predetermined time interval before updating the mapping of the received plurality of domain names to the received plurality of IP addresses.

8. A non-transitory machine-readable storage medium comprising instructions that when executed by a processing resource cause a computing device to:

receive a plurality of domain names and a plurality of IP addresses;

determine a mapping of the received plurality of domain names to the received plurality of IP addresses;

identify domain names from the received plurality of domain names that belong to an approved domain name list or to a disapproved domain name list;

identify IP addresses from the received plurality of IP addresses that belong to an approved IP address list or to a disapproved IP address list;

for an unknown IP address from the received plurality of IP addresses and domain names that map to the unknown IP address, determine, by at least one processor, if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list;

in response to a determination that more than the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designate the unknown IP address as approved and assigning the unknown IP address to the approved IP address list; and

in response to a determination that less than or equal to the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list, designate the unknown IP address as disapproved and assigning the unknown IP address to the disapproved IP address list.

9. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the computing device to:

for an unknown domain name from the received plurality of domain names and IP addresses that map to the unknown domain name, determine if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list;

in response to a determination that more than the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designate the unknown domain name as approved and assigning the unknown domain name to the approved domain name list; and

in response to a determination that less than or equal to the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, designate the unknown domain name as disapproved and assigning the unknown domain name to the disapproved domain name list.

10. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the computing device to:

assign a confidence interval to the designation of the unknown IP address as approved or disapproved;

determine if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designate the unknown IP address as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designate the unknown IP address as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list.

11. The non-transitory machine-readable storage medium of claim 9 , wherein the instructions further cause the computing device to:

assign a confidence interval to the designation of the unknown domain name as approved or disapproved;

determine if the confidence interval is greater than a predetermined confidence interval threshold;

in response to a determination that the confidence interval is greater than the predetermined confidence interval threshold, designate the unknown domain name as unknown; and

in response to a determination that the confidence interval is less than or equal to the predetermined confidence interval threshold, designate the unknown domain name as approved or disapproved based on the determination that more than, or less than or equal to, the predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list.

12. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the computing device, when determining if more than a predetermined percentage of the domain names that map to the unknown IP address are in the approved domain name list further, to:

compute an adjusted fraction related to the domain names that map to the unknown IP address by:

account for a total number of the received plurality of domain names, and

account for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

compare the computed adjusted fraction to a threshold to determine whether the unknown IP address is designated as approved or as disapproved.

13. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the computing device, when determining if more than a predetermined percentage of the IP addresses that map to the unknown domain name are in the approved IP address list, to:

compute an adjusted fraction related to the IP addresses that map to the unknown domain name by:

accounting for a total number of the received plurality of IP addresses, and

accounting for an average of all fractions of nodes of a bipartite graph used to represent the mapping of the received plurality of domain names to the received plurality of IP addresses; and

compare the computed adjusted fraction to a threshold to determine whether the unknown domain name is designated as approved or as disapproved.

14. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the computing device to:

mark a time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses;

determine if the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds a predetermined time interval based on a current time;

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses exceeds the predetermined time interval based on the current time, update the mapping of the received plurality of domain names to the received plurality of IP addresses; and

in response to a determination that the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses is less than or equal to the predetermined time interval based on the current time, wait for the time associated with the receiving of the plurality of domain names and the receiving of the plurality of IP addresses to exceed the predetermined time interval before updating the mapping of the received plurality of domain names to the received plurality of IP addresses.