Abstract: A computer-implemented method for automatically responding to domain name abuse is described. The method comprises the following steps. A plurality of disparate abuse feeds are received from a plurality of service providers. Each of the service providers is configured to collect information regarding a subset of potential domain name abuse and each abuse feed comprises data identifying domain names associated with the subset of potential domain name abuse. The data is filtered to create a custom abuse feed comprising a selective portion of the plurality of disparate abuse feeds. The filtered data from the custom abuse feed is grouped into groups of data based on predefined priority levels of the filtered data. For each of the groups of data, one or more corresponding workflows is executed as a response to the potential domain name abuse, wherein the workflow includes temporarily suspending a domain associated with the potential domain name abuse.

Abstract: A method for providing an abuse sentry service for responding to domain name abuse is described. The method comprises the following steps. A plurality of disparate abuse feeds is received, each comprising data relating to a subset of potential domain name abuse. Filters are applied to the data to create a custom abuse feed. Data from the custom abuse feed is grouped based on priority levels. For each of the groups, one or more corresponding workflows are executed as a response to the potential domain name abuse. A computer readable medium including instructions for implementing the method is also described.

Abstract: The system and method for predictive modeling in a network security service described herein may provide a scalable architecture that can model information relating to any specific threat or potential threat in a network and manage routing requests relating to the threat information among various entities participating in the security service. In particular, the scalable architecture may include various distributed databases that store serialized information describing threat instances, wherein a detection service may maintain information identifying entities associated with the databases storing the serialized information. Further, the security service may include a hierarchical subscriber name service that participating entities can traverse to locate the serialized threat information in the various databases and evaluate how the threat instances may have evolved or progressed through the network.

Abstract: The system and method for predictive modeling in a network security service described herein may provide a scalable architecture that can model information relating to any specific threat or potential threat in a network and manage routing requests relating to the threat information among various entities participating in the security service. In particular, the scalable architecture may include various distributed databases that store serialized information describing threat instances, wherein a detection service may maintain information identifying entities associated with the databases storing the serialized information. Further, the security service may include a hierarchical subscriber name service that participating entities can traverse to locate the serialized threat information in the various databases and evaluate how the threat instances may have evolved or progressed through the network.