Anomaly detector for domain registries — Verisign patents

Patent describes way to track unusual registration activity.

Flowchart showing how Verisign's patent for anomaly detection works

The U.S. Patent and Trademark Office has granted patent number 11,190,479 (pdf) to Verisign (NASDAQ: VRSN) for “Detection of aberrant domain registration and resolution patterns.”

The patent describes a system that checks for anomalies in domain name registrations and resolution.

On the registration side, it could track metrics such as:

Fresh registrations per registrar or registrar family
Fresh registrations per registrant’s country
Fresh registrations per domain length
Average number of vowels for fresh registrations
Average number of consonants for fresh registrations
Deleted names per registrar or registrar family
Number of occurrences of a character in fresh registrations

and then check instances in which the data change beyond certain bounds. This could be used to track promotions, malware registrations, etc.

Verisign claims the idea could also be applied to DNS resolution to check for anomalies that might indicate a DDoS attack.

I would imagine that most sizable registries have some sort of anomaly detection built into their tracking dashboards.

Verisign applied for the patent on May 23, 2017, and it was granted today.

Also on the wire