Patent Application
20230388322
This disclosure relates generally to the computer and networking security field, and more particular, to detecting domain name system (DNS) tunneling.
DNS can be used to resolve a particular domain name to its Internet Protocol (IP) equivalent. Each domain name can be associated with a particular IP address. IP address lookups are performed by DNS servers. A website address is associated with one or more name servers which are responsible for resolving the IP address of the website. A seemingly benign DNS traffic can be abused by cyber criminals to transfer exploits from a victim's endpoint. Using DNS to open a side channel for transferring sensitive information from a victim's computer is called DNS tunneling (DNST).
Computers on the Internet, from a smartphone or laptop to servers that serve content for massive websites, can find and communicate with one another by using IP addresses. The Internet's DNS system performs IP address lookup by managing a mapping between domain names and IP addresses. Each domain name is associated with a particular IP address. These IP address lookups are performed by DNS servers. A DNS server can resolve a domain name to its IP equivalent. DNS servers can include root name servers, top level domain (TLD) name server, and authoritative name servers. An example DNS process can be performed as follows. First, a DNS request is obtained by a user equipment (UE) in response to a user entering a web site in a web browser. The UE may search its own DNS caches to see if requested information (e.g. an IP address of the web site) is already stored locally. If not, the DNS request is routed to a DNS resolver. The DNS resolver may be managed by the user's Internet service provider (ISP), such as a cable Internet provider, a digital subscriber line (DSL) broadband provider, or a corporate network, etc.
If the DNS request is routed to the DNS resolver, the DNS resolver may check its own cache to determine if the requested information is already stored locally in the DNS resolver. If the requested information is stored locally in the DNS solver, the DNS resolver may return the requested information to the UE. If the requested information is not stored locally in the DNS resolver, the DNS resolver may continue to route the DNS request to a root name server. The root name server may determine a TLD based on the DNS request and send information about the TLD back to the DNS resolver. In some cases, the information about the TLD can indicate a TLD server configured for the TLD. Then, the DNS resolver determines the TLD server based on the information about the TLD and queries the TLD server for the requested information. The TLD server may provide the DNS resolver with information of an authoritative name server. The DNS resolver can query the authoritative name server to obtain the requested information. After obtaining the requested information, the DNS resolver may cache the requested information and return it to the UE.
DNS tunneling (DNST) involves abuse of an underlying DNS protocol, for example, by using DNS requests to implement a command and control channel for malware. Inbound DNS traffic can carry commands to the malware, while outbound traffic can infiltrate a user's computer to extract sensitive data or provide responses to the malware operator's requests. A subdomain included in the DNS request can be used to carry sensitive information. Malicious DNS requests can be designed to go to attacker-controlled DNS servers, allowing the cyber attackers to receive the DNS requests and return DNS replies. Some indicators of DNST on a network can include unusual DNS requests, requests for unusual domains, and high DNS traffic volume, etc. An unusual DNS request may include unusual data encoded within a domain name. Inspection of the domain name within DNS requests may enable differentiation of legitimate traffic from attempted DNST. A request for unusual domains may include domain names that are suspiciously owned by cyber attackers. If a system or computer is experiencing a sudden surge in requests for an unusual domain, it may indicate DNST, especially if that domain was only created recently. High DNS traffic volume can be indicated by spikes in DNS traffic. Because a domain name within a DNS request usually has a maximum size (e.g., 253 characters), an attacker likely will need a large number of malicious DNS requests to perform data exfiltration or implement a highly-interactive command and control protocol. The resulting spike in DNS traffic can be an indicator of DNST. Protection against DNST includes detection and blocking of attempted data exfiltration. Example DNST detection systems and methods are described in greater detail below.
At a high level, system 100 can be configured to detect DNST based on machine learning models/algorithms combined with statistical analysis. In some cases, the machine learning model as described herein can be a support vector machine (SVM) model. In some cases, the machine learning model can be an artificial neural network (ANN). In some cases, the machine learning model can be any suitable machine learning model to be used for DNST. In the description below with reference to
In an example DNST detection process with reference to the system 100, a UE 110 may send a DNS request to a trusted DNS server 120. The DNS request may include a web address. The trusted DNS server 120 can be configured as a DNS resolver that acts as an intermediary between the UE 110 and the name servers 140. In one example, the trusted DNS server 120 may be configured to receive DNS requests from and return DNS responses to the UE 110. The trusted DNS server 120 can be configured to perform initial processing on a DNS request from the UE 110 and determine whether a response to the DNS request is already stored locally, e.g., in a memory cache of the trusted DNS server 120. If the response is already cached locally, the trusted DNS server 120 may send the cached response to the UE 110. If the response is not already cached locally, the trusted DNS server 120 may route the DNS request to a name server 140 via a network gateway 130.
In some cases, the network gateway 130 is configured to provide a connection between the trusted DNS server 120 and one or more name servers 140. In some cases, the trusted DNS server can be implemented in a first network, and the name servers 140 can be implemented in a second network. The network gateway 130 may be configured to provide a connection between the first and second networks to allow data transmission between the two networks. The network gateway 130 may be a wireless router, a wireless access point, a modem cum router, a set-top box, a zero trust network access (ZTNA) point, or any suitable computing device.
The name servers 140 can include one or more root name servers, one or more TLD name servers, and one or more authoritative name servers. In one example, a root name server may be a name server for a root zone of the DNS of the Internet. A root name server may be configured to store addresses of TLD name servers. A root name server can directly answer queries for records stored or cached within the root zone, and also refer other requests to an appropriate TLD server. In one example, a root name server may accept a DNS resolver's query which includes a domain name, and respond by directing the DNS resolver to a TLD name server based on the extension of the domain name. TLD name servers are at a relatively lower hierarchy than root name servers in the DNS hierarchy. A TLD name server may be configured to store TLD specific records, e.g., by maintaining information for domain names that share a common domain extension. When a DNS resolver receives a response from a TLD name server, the DNS resolver may be directed to an authoritative name server indicated in the response. An authoritative name server may contain information specific to a domain name it serves and provide the DNS resolver with information about a requested IP address that is directed to a web server.
In response to receiving a DNS request routed by the trusted DNS server 120 and the network gateway 130, a root name server 140 may provide the trusted DNS server 120 with information about a TLD name server 140 based on information contained in the DNS request. Then, the trusted DNS server 120 may send a DNS request to the TLD name server 140 based on a response from the root name server 140. The TLD name server 140 may respond to the trusted DNS server 120 with information about an authoritative name server 140. Again, the trusted DNS server 120 may send a DNS request to the authoritative name server 140 based on a response from the TLD name server 140. The authoritative name server 140 may return a requested IP address to the trusted DNS server 120. The trusted DNS server 120 may forward the requested IP address to the UE 110. The trusted DNS server 120 may further cache the requested IP address for a predetermined time. The IP address may be directed to a web server 150. After receiving the IP address from the trusted DNS server 120, the UE 110 may send a web request to the web server 150 based on the IP address. The web server 150 may respond with the requested web content to the UE 110.
During a DNS process, a cyber-attacker may configure the cyber-attacker's own computer as a name server 140 to perform DNST. A DNS request sent by the UE 110 may be routed to the cyber-attacker's own computer, which in turn may respond with encoded response that includes malware used to compromise data security of the UE 110.
As shown, a DNST detection device 170 is configured to include a machine learning module 1701 and a statistical analysis module 1702. In some cases, the machine learning module 1701 can be configured to process DNS requests using a machine learning (e.g., SVM, or ANN, etc.) model. The SVM model is used below as an example of the machine learning model in the methods and systems as described herein. The SVM model may be implemented using a supervised machine learning algorithm for classification. In one example, classification may be performed using the SVM model on the DNS requests to determine suspicious DNS requests. The machine learning module 1701 can be configured to analyze subdomains of the DNS requests, compute entropies of characters of the subdomains, generate entropy vectors, and perform Fourier transform on the entropy vectors. The transformed vectors may be fed to the SVM model. The machine learning module 1701 can use the SVM model to determine suspicious DNS requests based on the transformed vectors. Determination of the suspicious DNS requests will be discussed below in greater detail with reference to
Continuing with the above example, statistical analysis may be further performed on the suspicious DNS requests to determine whether any one of the suspicious DNS requests is a potentially malicious DNS request. In some cases, the statistical analysis module 1702 can be configured to perform statistical analysis on DNS requests using a statistical analysis model. In one example, the statistical analysis module 1702 may obtain suspicious domains contained in the suspicious requests, compute a ratio of unique subdomains to a total number of DNS requests observed for a suspicious domain during a predetermined time period, and determine whether the suspicious domain is a potentially malicious domain based on the computed ratio. A malicious DNS request may then be determined as a DNS request that contains a potentially malicious domain. Statistical analysis of the DNS requests will be discussed below in greater detail with reference to
In some cases, the DNST detection device 170 is further configured to provide remedial actions in response to detection of DNST. For example, the DNST detection device 170 may decline or block a DNS request in response to determining that the DNS request is a potentially malicious DNS request. The DNST detection device 170 may add a potentially malicious domain to a black list and block all DNS traffic related to the potentially malicious domain.
In some cases, the DNST detection device 170 can be communicatively connected to the trusted DNS server 120 and/or the network gateway 130. In some cases, the DNST detection device 170 can be implemented as a device different from a device on which the trusted DNS server 120 or the network gateway 130 is implemented. For example, the DNST detection device 170 can be configured as a device connected externally to the trusted DNS server 120 and the network gateway 130. In some cases, the DNST detection device 170 can be configured as a connection device between the trusted DNS server 120 and the network gateway 130. In some cases, the DNST detection device can be implemented on a same device on which the trusted DNS server 120 or the network gateway 130 is implemented.
The process 200 may begin at step 210, where a plurality of DNS requests are received. In one example with reference to
Referring back to
In some cases, the plurality of DNS requests can be processed, e.g. by the system 100, to generate a plurality of transformed vectors to be fed into the SVM model. An example process 400 of generating the transformed vectors is shown in
In some cases, a normal domain may be misclassified as a suspicious domain. For example, DNS request including subdomains directed to content delivery networks (CDNs) are among the normal traffics that may be detected as DNST because the CDN subdomains can be abnormally high entropy subdomains. Performing Fourier transform on the entropy vectors and feeding the transformed vectors to the SVM model can improve accuracy in detection of the suspicious domains.
Referring back to
In some cases, the subdomains may be stored by the system 100 for a predetermined time period. To improve storage space efficiency, a Bloom filter of each subdomain may be stored in the system 100. In one example, an empty Bloom filter includes a bit array of n bits that are all set to zero initially. To set the Bloom filter corresponding to a given input, a number of hash functions may be applied to the given input to compute a number of hash values. The hash values may indicate positions of bits in the Bloom filter that will be set to one. The Bloom filter corresponding to the give input may then be generated by setting the bits corresponding to the hash values to one. Storing Bloom filters of the subdomains instead of storing the subdomains can improve space efficiency of the storage of the system 100.
The statistical analysis module 1702 may determine one or more potentially malicious domains among the suspicious domains based on the ratio computed for each suspicious domain. In one example, an arithmetic mean of ratios for all the suspicious domains observed over a predetermined time period is computed. Then, a standard deviation may be computed based on the variation of the computed ratios with respect to the arithmetic mean. A threshold may be determined based on the standard deviation and the arithmetic mean. In one example, the threshold may be determined as equal to arithmetic mean+3*standard deviation. If a ratio computed for a suspicious domain exceeds the determined threshold, the suspicious domain may be determined as a potentially malicious domain. If a ratio computed for a suspicious domain does not exceed the determined threshold, the suspicious domain may be determined as a normal domain. In some cases, a suspicious DNS request that includes a potentially malicious domain may be determined as a potentially malicious DNS requests.
Combining statistical approach with the SVM can improve the accuracy in DNST detection.
Determination of potentially malicious DNS domains based on the ratio instead of unique subdomains alone can improve accuracy of the DNST detection with reference to
In some aspects, the computer 1200 may comprise a computer that includes an input device, such as a keypad, keyboard, touch screen, or other device that can accept user information, and an output device that conveys information associated with the operation of the computer 1200, including digital data, visual, or audio information (or a combination of information), or a graphical user interface (GUI).
The computer 1200 can serve in a role as a client, network component, a server, a database or other persistency, or any other component (or a combination of roles) of a computer system for performing the subject matter described in the instant disclosure. The illustrated computer 1200 can be communicably coupled with a network (not shown). In some implementations, one or more components of the computer 1200 may be configured to operate within environments, including cloud-computing-based, local, global, or other environment (or a combination of environments).
At a high level, the computer 1200 is an electronic computing device operable to receive, transmit, process, store, or manage data and information associated with the described subject matter. According to some implementations, the computer 1200 may also include, or be communicably coupled with, an application server, e-mail server, web server, caching server, streaming data server, or other server (or a combination of servers).
The computer 1200 can receive requests over a network from a client application (for example, executing on another computer 1200) and respond to the received requests by processing the received requests using an appropriate software application(s). In addition, requests may also be sent to the computer 1200 from internal users (for example, from a command console or by other appropriate access methods), external or third-parties, other automated applications, as well as any other appropriate entities, individuals, systems, or computers.
Each of the components of the computer 1200 can communicate using a system bus (not shown). In some implementations, any or all of the components of the computer 1200, hardware or software (or a combination of both hardware and software), may interface with each other or the interface 1202 (or a combination of both), over the system bus using an application programming interface (API) 1210 or a service layer 1212 (or a combination of the API 1210 and service layer 1212). The API 1210 may include specifications for routines, data structures, and object classes. The API 1210 may be either computer-language independent or dependent and refer to a complete interface, a single function, or even a set of APIs. The service layer 1212 provides software services to the computer 1200 or other components (whether or not illustrated) that are communicably coupled to the computer 1200. The functionality of the computer 1200 may be accessible for all service consumers using this service layer. Software services, such as those provided by the service layer 1212, provide reusable, defined functionalities through a defined interface. For example, the interface may be software written in JAVA, C++, or other suitable language providing data in extensible markup language (XML) format or other suitable formats. While illustrated as an integrated component of the computer 1200, alternative implementations may illustrate the API 1210 or the service layer 1212 as stand-alone components in relation to other components of the computer 1200 or other components (whether or not illustrated) that are communicably coupled to the computer 1200. Moreover, any or all parts of the API 1210 or the service layer 1212 may be implemented as child or sub-modules of another software module, enterprise application, or hardware module without departing from the scope of this disclosure.
The computer 1200 includes an interface 1202. Although illustrated as a single interface 1202 in
The computer 1200 includes one or more processors 1204. Although illustrated as a single processor 1204 in
The computer 1200 also includes a database 1216 that can hold data for the computer 1200 or other components (or a combination of both) that can be connected to a network (whether illustrated or not). For example, database 1216 can be an in-memory, conventional, or other type of database storing data consistent with this disclosure. In some implementations, database 1216 can be a combination of two or more different database types (for example, a hybrid in-memory and conventional database) according to particular needs, desires, or particular implementations of the computer 1200 and the described functionality. Although illustrated as a single database 1216 in
The computer 1200 also includes a memory 1206 that can hold data for the computer 1200 or other components (or a combination of both) that can be connected to the network (whether illustrated or not). For example, memory 1206 can be Random Access Memory (RAM), Read Only Memory (ROM), optical, magnetic, and the like, storing data consistent with this disclosure. In some implementations, memory 1206 can be a combination of two or more different types of memory (for example, a combination of RAM and magnetic storage) according to particular needs, desires, or particular implementations of the computer 1200 and the described functionality. Although illustrated as a single memory 1206 in
The application 1208 is an algorithmic software engine providing functionality according to particular needs, desires, or particular implementations of the computer 1200, particularly with respect to functionality described in this disclosure. For example, application 1208 can serve as one or more components, modules, or applications. Further, although illustrated as a single application 1208, the application 1208 may be implemented as multiple applications 1208 on the computer 1200. In addition, although illustrated as integral to the computer 1200, in alternative implementations, the application 1208 can be external to the computer 1200.
The computer 1200 can also include a power supply 1214. The power supply 1214 can include a rechargeable or non-rechargeable battery that can be configured to be either user- or non-user-replaceable. In some implementations, the power supply 1214 can include power-conversion or management circuits (including recharging, standby, or other power management functionality). In some implementations, the power supply 1214 can include a power plug to allow the computer 1200 to be plugged into a wall socket or other power source to, for example, power the computer 1200 or recharge a rechargeable battery.
There may be any number of computers 1200 associated with, or external to, a computer system containing computer 1200, each computer 1200 communicating over a network. Further, the term “client,” “user,” and other appropriate terminology may be used interchangeably, as appropriate, without departing from the scope of this disclosure. Moreover, this disclosure contemplates that many users may use one computer 1200, or that one user may use multiple computers 1200.
It is expressly understood that the described implementations of the subject matter can include one or more features, alone or in combination. For example, in an implementation, a plurality of domain name system (DNS) requests to access one or more domains are received. The plurality of DNS requests are processed, by using a support vector machine (SVM) model, to determine one or more suspicious DNS requests among the plurality of DNS requests. The one or more suspicious DNS requests are processed, by using a statistical analysis model, to determine whether the one or more suspicious DNS requests are potentially malicious DNS requests.
The foregoing and other described aspects may be implemented using a system, a method, or a computer program, or any combination of systems, methods, and computer programs. The foregoing and other described embodiments can each, optionally, include one or more of the following features. It is contemplated that these features may be combined with one or more of the forgoing implementations.
A first feature, combinable with any of the following features, includes: determining a plurality of strings corresponding to a plurality of subdomains comprised in the plurality of DNS requests, respectively; determining a plurality of entropy vectors corresponding to the plurality of strings; and determining, by using a SVM model, one or more suspicious DNS requests based on the plurality of entropy vectors.
A second feature, combinable with any of the above and the following features, includes: for each of the plurality of strings corresponding to a DNS request, determining a plurality of characters comprised in a string; compute an entropy for each of the plurality of characters; and compute an entropy vector for the string based a plurality of entropies computed for the plurality of characters.
A third feature, combinable with any of the above and the following features, includes: performing Fourier transform on the plurality of entropy vectors to generate a plurality of transformed vectors; and processing, by using the SVM model, the plurality of transformed vectors to determine the one or more suspicious DNS requests.
A fourth feature, combinable with any of the above and the following features, includes: determining, as one or more suspicious domains, one or more domains comprised in the one or more suspicious DNS requests; for each of the one or more suspicious domains, determining a ratio of unique subdomains associated with a suspicious domain to a total number of DNS requests associated with the suspicious domain; determining at least one potentially malicious domain among the one or more suspicious domains based on a ratio corresponding to each of the one or more suspicious domains; and determining whether the one or more suspicious DNS requests are potentially malicious DNS requests by determining whether the one or more suspicious DNS requests comprise the at least one potentially malicious domain.
A fifth feature, combinable with any of the above and the following features, includes: for each of the one or more suspicious domains, determining the total number of DNS requests associated with a suspicious domain within a predetermined time period; determining a number of unique subdomains comprised in the total number of DNS requests associated with the suspicious domain; and determining a ratio of the number of unique subdomains to the total number of DNS requests associated with the suspicious domain.
A sixth feature, combinable with any of the above features, includes: in response to determining a suspicious DNS request is a potentially malicious DNS request, declining the suspicious DNS request.
Implementations of the subject matter and the functional operations described in this specification can be implemented in digital electronic circuitry, in tangibly embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Implementations of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory computer-storage medium for execution by, or to control the operation of, data processing apparatus. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer-storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.
The terms “data processing apparatus,” “computer,” or “electronic computer device” (or equivalent as understood by one of ordinary skill in the art) refer to data processing hardware and encompass all kinds of apparatus, devices, and machines for processing data, including by way of example, a programmable processor, a computer, or multiple processors or computers. The apparatus can also be or further include special purpose logic circuitry, e.g., a central processing unit (CPU), an FPGA (field programmable gate array), or an ASIC (application specific integrated circuit). In some implementations, the data processing apparatus and/or special purpose logic circuitry may be hardware-based and/or software-based. The apparatus can optionally include code that creates an execution environment for computer programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them. The present disclosure contemplates the use of data processing apparatus with or without conventional operating systems, for example LINUX, UNIX, WINDOWS, MAC OS, ANDROID, IOS or any other suitable conventional operating system.
A computer program, which may also be referred to or described as a program, software, a software application, a module, a software module, a script, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and it can be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, e.g., files that store one or more modules, sub programs, or portions of code. A computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a communication network. While portions of the programs illustrated in the various figures are shown as individual modules that implement the various features and functionality through various objects, methods, or other processes, the programs may instead include a number of sub-modules, third-party services, components, libraries, and such, as appropriate. Conversely, the features and functionality of various components can be combined into single components, as appropriate.
The processes and logic flows described in this specification can be performed by one or more programmable computers, executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by, and apparatus can also be implemented as, special purpose logic circuitry, e.g., a CPU, an FPGA, or an ASIC.
Computers suitable for the execution of a computer program can be based on general or special purpose microprocessors, both, or any other kind of CPU. Generally, a CPU will receive instructions and data from a ROM or a RAM or both. The essential elements of a computer are a CPU for performing or executing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to, receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a PDA, a mobile audio or video player, a game console, a GPS receiver, or a portable storage device, e.g., a USB flash drive, to name just a few.
Computer readable media (transitory or non-transitory, as appropriate) suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto optical disks; and CD ROM, DVD+/−R, DVD-RAM, and DVD-ROM disks. The memory may store various objects or data, including caches, classes, frameworks, applications, backup data, jobs, web pages, web page templates, database tables, repositories storing business and/or dynamic information, and any other appropriate information including any parameters, variables, algorithms, instructions, rules, constraints, or references thereto. Additionally, the memory may include any other appropriate data, such as logs, policies, security or access data, reporting files, as well as others. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.
To provide for interaction with a user, implementations of the subject matter described in this specification can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube), LCD, LED, or plasma monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse, trackball, or trackpad by which the user can provide input to the computer. Input may also be provided to the computer using a touchscreen, such as a tablet computer surface with pressure sensitivity, a multi-touch screen using capacitive or electric sensing, or other type of touchscreen. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user's client device in response to requests received from the web browser.
The term “graphical user interface,” or “GUI,” may be used in the singular or the plural to describe one or more graphical user interfaces and each of the displays of a particular graphical user interface. Therefore, a GUI may represent any graphical user interface, including but not limited to, a web browser, a touch screen, or a command line interface (CLI) that processes information and efficiently presents the information results to the user. In general, a GUI may include a plurality of user interface (UI) elements, some or all associated with a web browser, such as interactive fields, pull-down lists, and buttons operable by the business suite user. These and other UI elements may be related to or represent the functions of the web browser.
Implementations of the subject matter described in this specification can be implemented in a computing system that includes a back end component, e.g., such as a data server, or that includes a middleware component, e.g., an application server, or that includes a front-end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of wireline and/or wireless digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a radio access network (RAN), a metropolitan area network (MAN), a wide area network (WAN), Worldwide Interoperability for Microwave Access (WIMAX), a WLAN using, for example, 802.11 a/b/g/n and/or 802.20, all or a portion of the Internet, and/or any other communication system or systems at one or more locations. The network may communicate with, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and/or other suitable information between network addresses.
The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship with each other. In some implementations, any or all of the components of the computing system, both hardware and/or software, may interface with each other and/or the interface using an API and/or a service layer. The API may include specifications for routines, data structures, and object classes. The API may be either computer language independent or dependent and refer to a complete interface, a single function, or even a set of APIs. The service layer provides software services to the computing system. The functionality of the various components of the computing system may be accessible for all service consumers via this service layer. Software services provide reusable, defined business functionalities through a defined interface. For example, the interface may be software written in JAVA, C++, or other suitable language providing data in XML format or other suitable formats. The API and/or service layer may be an integral and/or a stand-alone component in relation to other components of the computing system. Moreover, any or all parts of the service layer may be implemented as child or sub-modules of another software module, enterprise application, or hardware module without departing from the scope of this disclosure.
While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any invention or on the scope of what may be claimed, but rather as descriptions of features that may be specific to particular implementations of particular inventions. Certain features that are described in this specification in the context of separate implementations can also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation can also be implemented in multiple implementations separately or in any suitable sub-combination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can, in some cases, be excised from the combination, and the claimed combination may be directed to a sub-combination or variation of a sub-combination.
Particular implementations of the subject matter have been described. Other implementations, alterations, and permutations of the described implementations are within the scope of the following claims as will be apparent to those skilled in the art. While operations are depicted in the drawings or claims in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed (some operations may be considered optional), to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous.
Moreover, the separation and/or integration of various system modules and components in the implementations described above should not be understood as requiring such separation and/or integration in all implementations, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.
Accordingly, the above description of example implementations does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure.
