Ranking services and top N rank lists
Techniques for ranking services and top N rank lists are disclosed. In some embodiments, a system, process, and/or computer program product for ranking services and top N rank lists includes receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data; aggregating the DNS related event data over a period of time and rank order by popularity; and generating a top N rank list for ranking popularity over the period of time for a set of domains using the aggregated DNS related event data and rank order by popularity.
1. A system, comprising:
a processor configured to:
receive a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
aggregate the DNS related event data over a period of time and rank order by popularity;
generate a top N rank list for ranking popularity over the period of time for a set of domains using the aggregated DNS related event data and rank order by popularity;
determine, using the top N rank list, rank intervals to generate a most likely rank and an interval range for the set of domains;
normalize the interval range for the set of domains based on a preset confidence interval to determine a normalized interval range for the set of domains;
output a rank intervals list for the set of domains based on the most likely rank and the normalized interval range for the set of domains; and
enforce a network policy using the rank intervals list, comprising to:
identify domains for a whitelist and/or a blacklist using the rank intervals list; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system recited in claim 1 , wherein the determining of the rank intervals using the top N rank list comprises to aggregate the set of network related event data over a set of consecutive period of days to obtain ranks over the period of time for the set of domains.
3. A method, comprising:
receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
aggregating the DNS related event data over a period of time and rank order by popularity;
generating a top N rank list for ranking popularity over the period of time for a set of domains using the aggregated DNS related event data and rank order by popularity;
determining, using the top N rank list, rank intervals to generate a most likely rank and an interval range for the set of domains;
normalizing the interval range for the set of domains based on a confidence interval to determine a normalized interval range for the set of domains;
outputting a rank intervals list for the set of domains based on the most likely rank and the normalized interval range for the set of domains; and
enforcing a network policy using the rank intervals list, comprising:
identifying domains for a whitelist and/or a blacklist using the rank intervals list.
4. The method of claim 3 , wherein the determining of the rank intervals using the top N rank list comprises:
aggregating the data over a set of consecutive period of days to obtain ranks over the period of time for a set of domains.
5. A computer program product, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:
receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
aggregating the DNS related event data over a period of time and rank order by popularity;
generating a top N rank list for ranking popularity over the period of time for a set of domains using the aggregated DNS related event data and rank order by popularity;
determining, using the top N rank list, rank intervals to generate a most likely rank and an interval range for the set of domains;
normalizing the interval range for the set of domains based on a confidence interval to determine a normalized interval range for the set of domains;
outputting a rank intervals list for the set of domains based on the most likely rank and the normalized interval range for the set of domains; and
enforcing a network policy using the rank intervals list, comprising:
identifying domains for a whitelist and/or a blacklist using the rank intervals list.
6. The computer program product recited in claim 5 , wherein the determining of the rank intervals using the top N rank list comprises aggregating the data over a set of consecutive period of days to obtain ranks over the period of time for a set of domains.