By: Tom Chmielarz
Alternative Data (DNS) used for $ADBE. When a computer user fires up commercial software, a request is generally sent to a licensing server to confirm a valid license. The data mining will focus on this key action.
The first step is
identifying specific licensing server's domain names. After packet
sniffing on software launch with Wireshark
(https://www.wireshark.org/)
and confirmation from Adobe support forums
(https://forums.adobe.com/thread/1004025)
we settled on the following list:
*.adobelogin.com
*.services.adobe.com
*.licenses.adobe.com
The next step is to
calculate what percent of the panel has made a connection to the
licensing servers in a given time frame (here, quarterly). This is a
bit more involved than it may initially appear. An accurate base
count of our own panel's “Active and Real Users” is needed.
Simply adding up all the unique IP addresses that have made requests
will not work. DNS Amplification Attacks
(https://deepthought.isc.org/article/AA-00897/0/What-is-a-DNS-Amplification-Attack.html)
have become quite popular in recent years. When directed at the data
source, they can significantly skew the real panel count upward. A
lot of time and effort would be expended individually parsing out
attack events. Instead, calculate the panel size from a list of
domains that are (1) heavily queried; (2) correspond to real internet
use; and (3) have small ANY response sizes. A few examples that
can be used:
google-analytics.com
quantserve.com
ntp.org
akamai.net
msftncsi.com
The data might look
something like the following:
Note: Not
real data. Please do not invest based on the presented chart.
Limitations and things to
keep in mind:
- This method will only capture active users. It can't capture those subscribers who haven't used the software in a while.
- Does not differentiate between types of licenses. Creative Cloud and Legacy programs are tracked just the same.
