Domain Name Inference from IP Addresses for HTTPS Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to track users' activities on websites and internet locations, especially for HTTPS transactions, as they lack information about the URL, making it difficult for communication service providers to determine content-level data usage and provide accurate billing to subscribers.
Innovation Solution
A computerized method is developed to infer domain names from IP addresses using in-stream lookups, contextual mapping, and associative mapping, which involves querying SSL exchanges, DNS records, Whois databases, reverse DNS lookups, and clickstream information to generate enriched records that include domain information, even for HTTPS transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional tracking methods are used for HTTP transactions, then domain names can be determined by analyzing URL fields, but these methods cannot be employed for HTTPS transactions where domain names are unknown
Solution Approach 1:
The patent introduces multiple intermediary data sources and mapping techniques to bridge the gap between IP addresses and domain names for HTTPS transactions. These intermediaries include SSL certificate information, DNS records, Whois databases, and clickstream data, which collectively enable domain name inference without direct URL access in encrypted HTTPS transactions
Solution Approach 2:
The patent segments the domain name resolution process into multiple independent lookup methods (SSL exchanges, DNS records, Whois queries, reverse DNS lookups, clickstream analysis). Each segment handles specific cases, and their results are combined to achieve comprehensive domain name identification across different protocols
2Quantity of substance
If flow records with IP addresses are used for tracking, then subscriber activity can be monitored, but content-level data usage details are lost without URL information
Solution Approach 1:
The patent performs preliminary actions by proactively querying multiple data sources (SSL exchanges, DNS records, Whois databases, clickstream information) to infer domain names from IP addresses before billing or analysis. This preliminary domain name retrieval preserves content-level usage information that would otherwise be lost in IP-address-only flow records
Solution Approach 2:
The patent implements feedback mechanisms where clickstream data and DNS lookup records are continuously analyzed to build and update databases of IP-to-domain mappings. This feedback loop enriches flow records with domain information, enabling accurate content-level tracking while maintaining broad protocol compatibility
3Measurement precision
If multiple lookup methods are performed to infer domain information, then domain accuracy improves, but processing time and system complexity increase
Solution Approach 1:
The patent applies partial action by selectively performing only the necessary lookup methods based on data availability and transaction type. Not all six lookup methods are executed for every flow record; instead, the system performs appropriate subsets (SSL exchanges for HTTPS, DNS for web traffic, Whois for IP ownership verification) to achieve sufficient domain name accuracy without unnecessary processing overhead
Data Source
AI summary
A method for inferring a domain for an IP address, the method including receiving a computerized flow record from a communication service provider including the IP address, wherein the IP address corresponds to a request from a subscriber for an Internet resource, performing an in-stream lookup including: determining whether any SSL exchanges result from the request for the Internet resource, when the SSL exchanges exist, attempting to retrieve domain information corresponding to the IP address from the SSL exchanges, determining whether any DNS records exist that include the IP address, and when the DNS records exist that include the IP address, attempting to retrieve the domain information corresponding to the IP address from the DNS records, performing contextual mapping including: performing a whois query using the IP address in an attempt to identify the domain information corresponding to the IP address, performing a reverse DNS lookup in an attempt to identify the domain information corresponding to the IP address, attempting to establish an SSL connection to the IP address to identify the domain information, and querying clickstream information from the content service provider in an attempt to identify the domain information.