Machine learning techniques for internet protocol address to domain name resolution systems

Abstract

An IP-to-Domain (IP2D) resolution system predicts which domain is most likely associated with an IP address. The resolution system generates unique source vote features (FSV) from (IP, domain, source) data. The FSV features are used to train a machine learning model that predicts which domain is most likely associated with an IP address. The domain predictions can then be used to more efficiently process events, more accurately calculate consumption scores, and more accurately detect associated company surges.

1 . One or more non-transitory computer readable media (NTCRM) comprising instructions for predicting network addresses to domain (NA2D) mappings using machine learning, wherein execution of the instructions by one or more processors is to cause a computing system to:
 identify a set of source vote features from NA2D source data;   generate scaled NA2D features based on feature scaling and dimensional reduction operations performed on the set of source vote features; and   apply the scaled NA2D features to a network address-domain (NAD) classification model to obtain a prediction dataset, wherein the prediction dataset indicates a probability that at least one domain maps to at least one IP address.   
     
     
         2 . The one or more NTCRM of  claim 1 , wherein execution of the instructions is to cause the computing system to:
 generate a training dataset;   perform classification on the training dataset; and   generate the NAD classification model based on the classification.   
     
     
         3 . The one or more NTCRM of  claim 2 , wherein execution of the instructions is to cause the computing system to:
 perform feature scaling and dimensional reduction on the training dataset; and   perform classification on the feature scaled and dimension reduced training dataset.   
     
     
         4 . The one or more NTCRM of  claim 3 , wherein, to generate the training dataset, execution of the instructions is operable to cause the computing system to:
 generate labeled NA2D training data by labeling a training set of source vote features with known correct and incorrect NA2D labels.   
     
     
         5 . The one or more NTCRM of  claim 4 , wherein, to perform the classification, execution of the instructions is operable to cause the computing system to:
 generate a first version of the NAD classification model using a first set of the labeled NA2D training data;   input a second set of the labeled NA2D training data into the first version of the NAD classification model; and   compare predictions output by the first version of the NAD classification model based on the second set of the labeled NA2D training data with labeled NA2D relationships.   
     
     
         6 . The one or more NTCRM of  claim 5 , wherein, to perform the classification, execution of the instructions is to cause the computing system to:
 generate a second version of the NAD classification model by refining feature weightings in the NAD classification model when the predictions output by the first version of the NAD classification model is less than a threshold value.   
     
     
         7 . The one or more NTCRM of  claim 1 , wherein:
 the NA2D source data includes NAD mappings generated by one or more sources, a timestamp of each NAD pair in the NAD mappings, and a profile associated with each NAD pair, the profiles of each NAD pair comprising a unique identifier associated with a user, organization, computing device, or network session event; and   the one or more sources include email sniffers, email logins, email opens, offline lookups, historical domain name registration records, and tags or scripts included in information objects or applications.   
     
     
         8 . The one or more NTCRM of  claim 7 , wherein execution of the instructions is to cause the computing system to:
 generate a vote matrix to include the set of source vote features.   
     
     
         9 . The one or more NTCRM of  claim 8 , wherein, to generate the vote matrix, execution of the instructions is to cause the computing system to:
 group the NA2D source data into network address-domain-source (ADS) keys; and   calculate a domain count, profile count, and a confusion value for each ADS key, the domain count is a total number of times a source of the one or more sources maps to an individual domain and to an individual IP address, the profile count is a number of unique profiles associated with each unique NAD mapping for a same source of the one or more sources, and the confusion value is an amount of source confusion or entropy associated with an NAD pair.   
     
     
         10 . The one or more NTCRM of  claim 2 , wherein the training data includes network addresses associated with known entities or network addresses associated with known networks. 
     
     
         11 . A network address to domain (NA2D) resolution system, comprising:
 a set of compute nodes configured to:
 generate an NA2D training dataset by labeling a set of source vote features with known correct and incorrect NA2D labels; 
 perform classification on the NA2D training dataset; and 
 generate an NA2D classifier model based on the classification. 
   
     
     
         12 . The NA2D resolution system of  claim 11 , wherein the set of compute nodes are configured to:
 perform feature scaling and dimensional reduction on the NA2D training dataset; and   perform the classification on the feature scaled and dimension reduced NA2D training dataset.   
     
     
         13 . The NA2D resolution system of  claim 12 , wherein, to generate the NA2D training dataset, the set of compute nodes are configured to:
 identify organization characteristics for IP addresses; and   combine the identified organization characteristics with the source vote features.   
     
     
         14 . The NA2D resolution system of  claim 11 , wherein, to perform the classification, the set of compute nodes are configured to:
 generate a first version of the NA2D classifier model using a first set of a labeled NA2D training data;   input a second set of the labeled NA2D training data into the first version of the NA2D classifier model; and   compare predictions output by the first version of the NA2D classifier model based on the second set of the labeled NA2D training data with labeled NA2D relationships.   
     
     
         15 . The NA2D resolution system of  claim 14 , wherein, to perform the classification, the set of compute nodes are configured to:
 generate a second version of the NA2D classifier model by refining feature weightings in the NA2D classifier model when the predictions output by the first version of the NA2D classifier model is less than a threshold value.   
     
     
         16 . The NA2D resolution system of  claim 11 , wherein the set of compute nodes are configured to:
 obtain the set of source vote features from NA2D source data;   generate scaled NA2D features based on feature scaling and dimensional reduction operations performed on the set of source vote features; and   apply the scaled NA2D features to the NA2D classifier model to obtain a prediction dataset, wherein the prediction dataset indicates a probability that at least one domain maps to at least one IP address.   
     
     
         17 . The NA2D resolution system of  claim 16 , wherein:
 the NA2D source data includes NAD mappings generated by one or more sources, a timestamp of each NAD pair in the NAD mappings, and a profile associated with each NAD pair, the profiles of each NAD pair comprising a unique identifier associated with a user, organization, computing device, or network session event; and   the one or more sources include email sniffers, email logins, email opens, offline lookups, historical domain name registration records, and tags or scripts included in information objects or applications.   
     
     
         18 . The NA2D resolution system of  claim 17 , wherein the set of compute nodes are configured to:
 generate a vote matrix to include the set of source vote features.   
     
     
         19 . The NA2D resolution system of  claim 18 , wherein, to generate the vote matrix, the set of compute nodes are configured to:
 group the NA2D source data into network address-domain-source (ADS) keys; and   calculate a domain count, profile count, and a confusion value for each ADS key, the domain count is a total number of times a source of the one or more sources maps to an individual domain and to an individual IP address, the profile count is a number of unique profiles associated with each unique NAD mapping for a same source of the one or more sources, and the confusion value is an amount of source confusion or entropy associated with an NAD pair.   
     
     
         20 . The NA2D resolution system of  claim 17 , wherein the NA2D resolution system is implemented by a set of technologies selected from a group comprising: a cloud computing service, a content delivery network (CDN), and an edge computing network.