Abstract: Systems, computer software and methods for calculating relatedness scores which are indicative of relatedness of pairs of domain names requested by clients are described. The method includes receiving DNS traffic data, wherein the DNS traffic data includes at least domain names requested by clients and identities of the clients requesting the domain names, generating sequences of the domain names based on the received DNS traffic data, collecting co-occurrence counts for queried pairs of domain names, applying a probabilistic association estimate to the collected counts to determine the relatedness scores of the queried pairs of domain names, and storing the determined relatedness scores.

Abstract: Systems, computer software and methods for calculating relatedness scores of domain names, which are indicative of relatedness of pairs of domain names requested by clients are described. The method includes receiving DNS traffic data, where the DNS traffic data includes at least domain names requested by the clients and identities of the clients requesting the domain names; generating, based on the identities of the clients, vectors including the requested domain names, where entries in the vectors correspond to client sessions in which the client has requested the domain names; reducing a dimensionality of the vectors by applying a dimensionality reduction method for generating reduced vectors; applying a similarity metric to the reduced vectors to calculate the relatedness scores; and storing the relatedness scores of the domain names.

Abstract: Systems, computer software and methods for searching plural domain names based on domain name system queries are described. The method includes receiving as input a domain name, searching a database for identifying scores measuring relatedness of the input domain name and other domain names of the plural domain names, retrieving related domain names with the highest relatedness scores, and associating the input domain name and the related domain names. The relatedness scores are calculated based on the domain name system queries of users.