Granted Patent B2

US 12,549,578 · App. 18/325,284 · Granted Feb 10, 2026

Inventors: David J. Mitchell (Danville, CA); Paul C. van Gool (Santa Barbara, CA)

Assignee: HYAS Infosec Inc.

H04L63/1425H04L63/1466

Abstract

Claims (61)

1 . A method comprising:

grouping DNS requests into one or more groups based on characteristics of the DNS requests;

identifying an outlier request of the DNS requests, wherein the outlier request is one of the DNS requests that is not included in the one or more groups; and

determining a remedial action from tiered remedial actions for the outlier request based on a distance of the outlier request to the one or more groups, wherein the tiered remedial actions correspond to different distances, wherein the tiered remedial actions include a first remedial action including blocking traffic associated with the outlier request and a second remedial action including investigating the outlier request, and wherein the first remedial action corresponds to a first distance that is longer than a second distance to which the second remedial action corresponds; and

performing the remedial action.

2 . The method of claim 1 , wherein identifying the outlier request comprises:

determining a device associated with the outlier request; and

determining a distance threshold associated with the device from device-specific distance thresholds indicating whether a DNS request is an outlier; and

determining that the distance satisfies the distance threshold.

3 . The method of claim 2 , wherein determining the distance threshold comprises:

determining a sensitivity level for the device; and

determining the distance threshold based on the sensitivity level, wherein distance thresholds of the device-specific distance thresholds are shorter for higher sensitivity levels.

4 . The method of claim 1 , comprising:

determining a device associated with the outlier request; and

selecting the tiered remedial actions from device-specific tiered remedial actions based on the device.

5 . The method of claim 4 , wherein selecting the tiered remedial actions comprises:

determining a sensitivity level for the device; and

determining the tiered remedial actions based on the sensitivity level.

6 . The method of claim 1 , wherein grouping the DNS requests comprises:

generating scores for the DNS requests from the characteristics; and

grouping the DNS requests into the one or more groups based on the scores.

7 . The method of claim 6 , wherein the distance comprises a difference between a score of the outlier request and a score of a group of the one or more groups.

8 . An apparatus comprising:

one or more computer readable storage media;

a processing system operatively coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the apparatus to:

group DNS requests into one or more groups based on characteristics of the DNS requests;

determine a device associated with a first DNS request of the DNS requests;

determine a distance threshold associated with the device from device-specific distance thresholds indicating whether a DNS request is an outlier not included in the one or more groups;

in response to determining that a distance of the first DNS request to the one or more groups satisfies the distance threshold, identify the first DNS request as being an outlier request of the DNS requests;

determine a remedial action from tiered remedial actions for the outlier request based on the distance, wherein the tiered remedial actions correspond to different distances; and

perform the remedial action.

9 . The apparatus of claim 8 , wherein the tiered remedial actions include a first remedial action including blocking traffic associated with the outlier request and a second remedial action including investigating the outlier request.

10 . The apparatus of claim 9 , wherein the first remedial action corresponds to a first distance that is longer than a second distance to which the second remedial action corresponds.

11 . The apparatus of claim 8 , wherein to determine the distance threshold, the program instructions direct the processing system to:

determine a sensitivity level for the device; and

determine the distance threshold based on the sensitivity level, wherein distance thresholds of the device-specific distance thresholds are shorter for higher sensitivity levels.

12 . The apparatus of claim 8 , wherein the program instructions direct the processing system to:

select the tiered remedial actions from device-specific tiered remedial actions based on the device.

13 . The apparatus of claim 12 , wherein to select the tiered remedial actions, the program instructions direct the processing system to:

determine a sensitivity level for the device; and

determine the tiered remedial actions based on the sensitivity level.

14 . The apparatus of claim 8 , wherein grouping the DNS requests comprises:

generate scores for the DNS requests from the characteristics; and

group the DNS requests into the one or more groups based on the scores.

15 . The apparatus of claim 14 , wherein the distance comprises a difference between a score of the first DNS request and a score of a group of the one or more groups.

16 . One or more non-transitory computer readable storage media having program instructions stored thereon, the program instructions, when read and executed by a processing system, direct the processing system to:

group DNS requests into one or more groups based on characteristics of the DNS requests;

identify an outlier request of the DNS requests, wherein the outlier request is one of the DNS requests that is not included in the one or more groups; and

determine a device associated with the outlier request;

determine a sensitivity level for the device;

select tiered remedial actions for the outlier request from device-specific tiered remedial actions based on the device and the sensitivity level;

determine a remedial action from the tiered remedial actions based on a distance of the outlier request to the one or more groups, wherein the tiered remedial actions correspond to different distances; and

perform the remedial action.

17 . The one or more non-transitory computer readable storage media of claim 16 , wherein the tiered remedial actions include a first remedial action including blocking traffic associated with the outlier request and a second remedial action including investigating the outlier request.

18 . A method comprising:

generating scores for DNS requests from characteristics of the DNS requests;

grouping the DNS requests into one or more groups based on the scores;

identifying an outlier request of the DNS requests, wherein the outlier request is one of the DNS requests that is not included in the one or more groups;

determining a remedial action from tiered remedial actions for the outlier request based on a score difference between a score of the outlier request and a score of a group of the one or more groups, wherein the tiered remedial actions correspond to different score differences; and

performing the remedial action.

Assignments (2)

Continuity (1)

References Cited (26)