# US 10,320,817 B2 · Systems and methods for detecting an attack on an auto-generated website by a virtual machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,817 B2 - Document ID: US10320817B2 - Status: Granted - Kind: B2 - Application number: 15/352,714 - Filed: 2016-11-16 - Published: 2018-05-17 - Granted: 2019-06-11 - Earliest claimed: 2016-11-16 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Hani Neuvirth-Telem; Elad Yom-Tov; Royi Ronen; Daniel Alon Hilevich - Web page: https://patentgrep.com/patent/US10320817B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for detecting an attack by a virtual or physical machine on one or more auto-generated websites is provided. The system includes a processor, a memory, and an application. The application is stored in the memory and includes instructions, which are executable by the processor. The instructions are configured to: access an index of a search engine server computer and determine uniform resource locators (URLs) of auto-generated websites, where the auto-generated websites include the one or more auto-generated websites; and access Internet protocol (IP) address-URL entries stored in a domain name system server computer. The instructions are also configured to: determine a first feature based on the URLs of the auto-generated websites and the IP address-URL entries; collect header data of packets transmitted to or received from the virtual or physical machine; determine a second feature based on the first feature and the header data; based on the second feature, generate a value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites; and perform a countermeasure based on the value. ## Claims ### Claim 1 A system for detecting an attack by a first virtual or physical machine on one or more auto-generated websites, the system comprising: a processor; a memory; and an application stored in the memory and including instructions, which are executable by the processor and that are configured to access an index of a search engine server computer and determine uniform resource locators (URLs) of a plurality of auto-generated websites, wherein the plurality of auto-generated websites include the one or more auto-generated websites; access a plurality of Internet protocol (IP) address-URL entries stored in a domain name system server computer; determine a first feature based on the URLs of the plurality of auto-generated websites and the IP address-URL entries, wherein the application, in determining the first feature, (i) determines which IP addresses in the IP address-URL entries are associated with hosting one of the plurality of auto-generated websites, and (ii) for each IP address in the IP address-URL entries, counts a number of corresponding URLs; collect header data of packets transmitted to or received from the first virtual or physical machine; determine a second feature based on the first feature and the header data; based on the second feature, generate a value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites; and perform a countermeasure based on the value. ### Claim 2 (depends on 1) The system of claim 1, wherein: the header data includes Internet protocol flow information export (IPFIX) data; and the application causes the processor to determine the second feature based on the IPFIX data. ### Claim 3 (depends on 1) The system of claim 1, wherein: the application is configured to determine a first plurality of features; the first plurality of features include the first feature; the application is configured to collect Internet protocol flow information export (IPFIX) data in headers of the packets transmitted to or received from the first virtual or physical machine; determine a second plurality of features based on (i) the first plurality of features, and (ii) the IPFIX data; and based on the second plurality of features, generate the value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites. ### Claim 4 (depends on 3) The system of claim 3, wherein the application, in determining the second plurality of features: determines a total number of IP addresses to which the first virtual or physical machine is communicating; determines a number of IP addresses of auto-generated websites to which the first virtual or physical machine is communicating; determines a ratio between the total number of IP addresses and the number of IP addresses of auto-generated websites to which the first virtual or physical machine is communicating; determines a number of synchronization transmission control protocol flags in outgoing communication of the first virtual or physical machine; and determines percentages of URLs corresponding to each IP address to which the first virtual or physical machine is communicating. ### Claim 5 (depends on 1) The system of claim 1, wherein the application is configured to generate the value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites based on a classification learning algorithm. ### Claim 6 (depends on 5) The system of claim 5, wherein the classification learning algorithm is a gradient boosted tree learning algorithm. ### Claim 7 (depends on 1) The system of claim 1, wherein the application is configured to: collect header data of packets transmitted to or received from a second virtual or physical machine; determine a third feature based on the first feature and the header data; based on the third feature, generate a second value indicative of whether the second virtual or physical machine has attacked one of the plurality of auto-generated websites; and perform the countermeasure based on the second value. ### Claim 8 A tangible computer readable device storing instructions executable by a processor for detecting an attack by a first virtual or physical machine on one or more auto-generated websites, the instructions comprising: determining uniform resource locators (URLs) of a plurality of auto-generated websites based on an index of a search engine server computer, wherein the plurality of auto-generated websites include the one or more auto-generated websites; accessing a plurality of Internet protocol (IP) address-URL entries in a domain name system server computer; determining a first feature based on the URLs of the plurality of auto-generated websites and the IP address-URL entries, wherein determining the first feature includes (i) determining which IP addresses in the IP address-URL entries are associated with hosting one of the plurality of auto-generated websites, and (ii) for each IP address in the IP address-URL entries, counting a number of corresponding URLs; collecting header data of packets transmitted to or received from the first virtual or physical machine; determining a second feature based on the first feature and the header data; based on the second feature, generating a value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites; and performing a countermeasure based on the value. ### Claim 9 (depends on 8) The tangible computer readable device of claim 8, further comprising instructions for determining the second feature based on Internet protocol flow information export (IPFIX) data, wherein the header data includes the IPFIX data. ### Claim 10 (depends on 8) The tangible computer readable device of claim 8, further comprising instructions for: determining a first plurality of features, wherein the first plurality of features include the first feature; collecting Internet protocol flow information export (IPFIX) data in headers of the packets transmitted to or received from the first virtual or physical machine; determining a second plurality of features based on (i) the first plurality of features, and (ii) the IPFIX data; and based on the second plurality of features, generating the value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites. ### Claim 11 (depends on 10) The tangible computer readable device of claim 10, wherein determining the second plurality of features includes: determining a total number of IP addresses to which the first virtual or physical machine is communicating; determining a number of IP addresses of auto-generated websites to which the first virtual or physical machine is communicating; determining a ratio between the total number of IP addresses and the number of IP addresses of auto-generated websites to which the first virtual or physical machine is communicating; determining a number of synchronization transmission control protocol flags in outgoing communication of the first virtual or physical machine; and determining percentages of URLs corresponding to each IP address to which the first virtual or physical machine is communicating. ### Claim 12 (depends on 8) The tangible computer readable device of claim 8, further comprising instructions for generating the value indicative of whether the first virtual or physical machine has attacked the one or more auto-generated websites based on a classification learning algorithm. ### Claim 13 (depends on 12) The tangible computer readable device of claim 12, wherein the classification learning algorithm is a gradient boosted tree learning algorithm. ### Claim 14 (depends on 8) The tangible computer readable device of claim 8, further comprising instructions for: collecting header data of packets transmitted to or received from a second virtual or physical machine; determining a third feature based on the first feature and the header data; based on the third feature, generating a second value indicative of whether the second virtual or physical machine has attacked one of the plurality of auto-generated websites; and performing the countermeasure based on the second value.