Abstract: Methods and systems for intelligently choosing an authoritative name server from among a group of name servers for resolving Domain Name System requests. Systems and methods are provided that enable choosing of a first server associated with and/or operated by a first service provider based on a first measurement associated with that first server. The systems and methods further comprise requesting first data from that first server, determining that the first server is unresponsive, and choosing a second server. The second server is chosen based on a second measurement, and chosen contingent on it being associated with and/or operated by to a different service provider than that associated with the first server. The systems and methods then comprise requesting second data from the second server.

Abstract: Systems and methods for scoring a domain web traffic based on DNS traffic requests received at an authoritative name server to resolve the domain name. A request to resolve the domain name is received at an authoritative name server. A counter, such as a server counter or a hit counter, for the domain name is incremented based on the received request. A score, such as a domain traffic score or a domain rank, is calculated based upon a count of the counter. Calculating the score may also include applying a weighting factor to the counters based on information about a requesting set of resolvers and other domains/websites that may be linking and driving traffic to the domain whose traffic score is being calculated. Examples of relevant set of resolvers information may include location, traffic levels, traffic type and architecture of the set of resolvers.

Abstract: Systems and methods are disclosed for identifying associations between binary samples, such as e-mail files and their attachments or a document and an executable program associated with the document. In one implementation, the method includes receiving a plurality of binary samples, and extracting metadata from the plurality of binary samples. The metadata for a binary sample from the plurality of binary samples includes a set of attributes of the binary sample. The method further includes identifying a set of associations between the plurality of binary samples based on the extracted metadata. Each association is characterized by at least one attribute the associated binary samples have in common, and each association has a confidence level indicative of a strength of the association. The method also includes identifying associations with a confidence level that exceeds a predefined threshold.

Abstract: Implementations of the present teachings relate to processes and systems for analyzing registrar and hosting provider relationships. In embodiments, the processes include compiling a list of domain names and matching each domain name with a registrar name and a hosting provider name. The processes also include generating a graph based on relationships between registrars and hosting providers. For example, the graph can represent the registrars and hosting providers as nodes and edges connecting the nodes can correspond to domain names that are registered by the registrar and hosted by the hosting provider. Further, the processes include applying graph metrics to the graph to identify key characteristics of a domain market.

Abstract: A method of recovering a registry includes accessing a plurality of registry zone files for the registry and archiving, on a first periodic basis, the plurality of registry zone files. Each of the registry zone files includes at least domain names, registrar IDs, and status information represented in a first predetermined format. The method also includes accessing bulk WHOIS data for the registry and archiving, on a second periodic basis, the bulk WHOIS data. The bulk WHOIS data includes at least nameserver server names, IP addresses, and status information represented in a second predetermined format. The method further includes validating one of the plurality of archived registry zone files based on a comparison between the plurality of registry zone files and the bulk WHOIS data, publishing the validated registry zone file to a second registry's nameservers, initiating a root zone change request, and updating authoritative nameservers.

Abstract: Command performance may be monitored. In a monitoring transaction, a product may be selected from a plurality of products in one group of a plurality of groups of products. Execution performance of a command by the selected product may be monitored. The monitored execution performance may be provided for determining compliance with a service level agreement for the product based on the monitored executed performance.

Abstract: A system, method, and computer-readable medium, is described that enables a registry recovery service to retrieve zone files from a target registry, archive the zone files, publish the zone files to a managed DNS server, reconcile ownership of the zone files, and publish the zone files to a provisioning DNS server. The registry recovery service may also implement a WHOIS server for the zone and ownership information and may also implement zone specific features particular to the target registry's TLD. The registry recovery service may also enable DNSSEC extensions on the recovered registry DNS services.

Abstract: A method, system, and computer-readable memory containing instructions include requesting a tokenizing authority to provide a tokenized string that represents a domain name, using the tokenized domain name string to perform a lookup against a database of registered tokenized domain name strings, determining whether the tokenized domain name string exists in the database, and returning results based on the existence of tokenized domain name strings and optionally variants thereof. The method, system, and computer-readable memory may further include returning an encryption key corresponding to an encrypted record of information related to the domain name corresponding to the tokenized domain name string.

Abstract: Systems and methods are provided for malware scanning and detection in a computing system. In one exemplary embodiment, the method includes launching, in a computing device of the computing system, a virtual machine, and launching, in the virtual machine of the computing device, an internet browser. The method also includes requesting, by the internet browser, data from a web page, and performing, using one or more analysis tools, analysis on the web page. In the method, performing analysis on the web page includes performing monitoring and recording of system application programming interface (API) calls, and creating software objects associated with the web page. The method also includes performing antivirus scanning of the software objects, de-obfuscating JavaScript associated with the software objects, and correlating data associated with the performed analysis to determine if the web page is a malicious web page.

Abstract: An apparatus and a non-transitory computer-readable medium may perform a method of minimizing the disclosure of a domain name contained in a DNS query. The method may include determining a first label and a second label associated with a domain name included in a DNS query. A first nameserver may be queried for a first resource record type associated with the first label without revealing information related to the second label by removing information related to the second label from the DNS query. A response may be received from the first nameserver, and the response may include the first resource record type which directs a resolver to a second nameserver. The second nameserver may be queried for a second resource record type associated with the first label and the second label.

Abstract: A method for providing Internet domain name suggestions includes parsing a web page; obtaining at least one keyword from the parsing, generating a first query from the at least one keyword; and determining, based at least on the first query, if at least one name suggestion is available. The method also includes, if at least one name suggestion is available, generating at least one domain name suggestion based at least on the first query and displaying the at least one domain name suggestion.

Abstract: Systems and methods are provided for using a hidden audio signal. In one exemplary embodiment, the method includes registering, at a central database, one or more of an identifier and a destination resource associated with the identifier, and encoding the one or more of the identifier and the destination resource in a hidden audio signal. The method further includes transmitting the hidden audio signal, including the one or more of the identifier and the destination resource, in connection with an acoustic signal, and receiving the acoustic signal at a user device. In addition, the method includes decoding the encoded one or more of the identifier and the destination resource at the user device; and requesting, from the central database, information associated with the one or more of the identifier and the destination resource. Further, the method includes receiving, at the user device, the requested information.

Abstract: Methods and systems for detecting aberrant behavior in time-series observation data, such as non-existent domain data, are disclosed. The methods and systems analyze the time-series observation data to determine time-series prediction data. The time-series observation data and time-series prediction data are used to determine a threshold that is based on the standard deviation of deviation values between the time-series observation data and time-series prediction data. The threshold may be used to detect aberrant behavior in subsequently obtained time-series observation data.

Abstract: Systems and methods for creating and using a domain profile include identifying a status of a first page associated with a domain. The first page is retrieved and additional pages from the domain are identified based on hyperlinks from the first page. The status of the additional pages is identified and the hyperlinks are prioritized based on the status and/or a comparison with predetermined data. Content is extracted from the first page and selected pages from among the additional pages. The specific additional pages may be selected based on the prioritization. The retrieved content may be processed through a signature marker set to determine a contextual match. A purpose of the domain is determined according to the status of the first page, the status of the additional pages and results of the processing of the content. The domain profile can be displayed, stored, sent and/or searched to identify web sites or attributes of interest.

Abstract: A mitigation service can monitor network traffic in one direction between a client computer and a server computer. The mitigation service can receive a request from a client computer to establish a network connection with a server computer. The mitigation service can reply to the client computer with an acknowledgment that is configured to cause the client computer to issue a request to reset the connection. The acknowledgement is configured not to affect the establishment of the network connection with the server computer. The mitigation service can compare the details of the reset request with the request to establish the network connection. If the details match, the mitigation service can forward the request to establish the network connection to the server computer.

Abstract: A system and method for providing a high reliability network. Context servers store information about calls in a telecommunications system. Network control elements can obtain call information from the context servers to help make call control and reporting decisions.

Abstract: A method for publishing a publication message includes receiving, at one of a plurality of first relays, a subscription request from a first client and transmitting the subscription request from the one of the plurality of first relays to first and second central relays of a plurality of central relays. The method also includes receiving, at another of the plurality of first relays, a publication request from a second client. The publication request includes the publication message. The method further includes transmitting the publication message from the another of the plurality of first relays to all of the plurality of central relays, transmitting the publication message from at least one of the first and second central relays to the one of the plurality of first relays, and transmitting the publication message from the one of the plurality of first relays to the first client.

Abstract: A method of detecting malicious software (malware) includes receiving a file and storing a memory baseline for a system. The method also includes copying the file to the system, executing the file on the system, terminating operation of the system, and storing a post-execution memory map. The method further includes analyzing the memory baseline and the post-execution memory map and determining that the file includes malware.

Abstract: A method for publishing a message includes receiving, at a first relay, a subscription request from a first client, wherein the subscription request includes a target. The method also includes: recording, at the first relay, subscription information of the first client based on the subscription request; receiving, at the first relay, a publication request from a second client, wherein the publication request includes a message string characterized by a pattern; determining, by the first relay, that the target matches at least a portion of the pattern; determining, by the first relay, if the publication request is a local publication request based on a predetermined policy rule; and transmitting the message string to the first client if the publication request is determined to be a local publication request.

Abstract: A system and method for authenticating an application (client) to a server or service. During a registration phase, an application that requests access to a service can receive a service identifier, which it can authenticate. The application can generate and send to the server or service an application-service key that is based upon the authenticated service identifier and a secret application key; a service-application identifier that can be based upon the authenticated service identifier and an application identifier; and a registration nonce, all of which can be stored at the server. During the authentication phase, the client can send to the server the application-service identifier, which the server can use to lookup the stored registration data. The server can send the registration nonce to the client, which can compute a proof of possession of the service-application key and send to the server. The server can compute its own version of this key and compare it to the received key.