Ranking services and top N rank lists
Techniques for ranking services and top N rank lists are disclosed. In some embodiments, a system, process, and/or computer program product for ranking services and top N rank lists includes receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data; aggregating the DNS related event data over a period of time and rank order by popularity; and generating a top N rank list for ranking popularity over the period of time for a set of domains using the aggregated DNS related event data and rank order by popularity.
1. A system, comprising:
a processor configured to:
receive a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
generate a top N rank list for ranking popularity over the period of time for a set of domains, wherein the period of time includes a T number of days;
determine rank intervals to generate a most likely rank and an interval range for a set of domains, comprising to:
determine T daily ranks for the T number of days for a domain of the set of domains based on the top N rank list, wherein the determining operation relates to one sample of the domain;
determine an average rank for the T daily ranks for the one sample; and
determine a rank interval based on average ranks for M samples of the domain; and
output, based on the most likely rank and the interval range, a rank interval list for the set of domains that is used by a network device to enforce a network security policy using the rank interval list; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system recited in claim 1 , wherein the processor is further configured to:
aggregate the DNS related event data and rank order by popularity.
3. The system recited in claim 1 , wherein the processor is further configured to:
aggregate the DNS related event data and rank order by popularity, wherein the generating of the top N rank list for ranking popularity over the period of time for a set of domains comprises to:
generate the top N rank list for ranking popularity over the period of time for the set of domains using the aggregated DNS related event data and rank order by popularity.
4. A method, comprising:
receiving, using a processor, a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
generating a top N rank list for ranking popularity over the period of time for a set of domains, wherein the period of time includes a T number of days;
determining rank intervals to generate a most likely rank and an interval range for a set of domains, comprising:
determining T daily ranks for the T number of days for a domain of the set of domains based on the top N rank list, wherein the determining operation relates to one sample of the domain;
determining an average rank for the T daily ranks for the one sample; and
determining a rank interval based on average ranks for M samples of the domain; and
outputting, based on the most likely rank and the interval range, a rank interval list for the set of domains that is used by a network device to enforce a network security policy using the rank interval list.
5. The method of claim 4 , further comprising:
aggregating the DNS related event data and rank order by popularity.
6. The method of claim 4 , further comprising:
aggregating the DNS related event data and rank order by popularity, wherein the generating of the top N rank list for ranking popularity over the period of time for a set of domains comprises:
generating the top N rank list for ranking popularity over the period of time for the set of domains using the aggregated DNS related event data and rank order by popularity.
7. A non-transitory computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a set of network related event data, wherein the set of network related event data includes Domain Name System (DNS) related event data;
generating a top N rank list for ranking popularity over the period of time for a set of domains, wherein the period of time includes a T number of days;
determining rank intervals to generate a most likely rank and an interval range for a set of domains, comprising:
determining T daily ranks for the T number of days for a domain of the set of domains based on the top N rank list, wherein the determining operation relates to one sample of the domain;
determining an average rank for the T daily ranks for the one sample; and
determining a rank interval based on average ranks for M samples of the domain; and
outputting, based on the most likely rank and the interval range, a rank interval list for the set of domains that is used by a network device to enforce a network security policy using the rank interval list.
8. The non-transitory computer program product recited in claim 7 , further comprising computer instructions for:
aggregating the DNS related event data and rank order by popularity.
9. The non-transitory computer program product recited in claim 7 , further comprising computer instructions for:
aggregating the DNS related event data and rank order by popularity, wherein the generating of the top N rank list for ranking popularity over the period of time for a set of domains comprises:
generating the top N rank list for ranking popularity over the period of time for the set of domains using the aggregated DNS related event data and rank order by popularity.