US 10,484,422 B2 · Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services

Abstract

A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.

Claims26

Dependent claims

A method for the prevention of malware over an existing internet service, comprising:

A) installing software on individual endpoints in a network, the software monitoring programs within the network and collecting information about where requests originated from, the software performing a method comprising:
B) generating a random entry to an internet service;
C) attempting to access the internet service with the random entry;
D) detecting the indication of the internet service's non-accessibility for the random entry;
E) repeating steps B) through D) one or more times;
F) logging into the internet service if there is a successful attempt;
G) comparing the results for the several attempts;
H) searching for the commonalities of the failed attempts;
I) marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts;
J) providing an indication of a malware attempt if a predetermined number of failed attempts have accrued.

7 more elements

A computer program product stored in a computer readable medium for prevention of malware over an existing internet service comprising:

a non-transitory computer readable medium;
a first program instruction for generating a random entry to an internet service;
a second program instruction for attempting to access the internet service with the random entry;
a third program instruction for detecting the indication of the internet service's non-accessibility for the random entry;
a fourth program instruction_ or iterating the first, second and third program instructions a predetermined number of times;
a fifth program instruction for logging into the internet service if there is a successful attempt;
a sixth program instruction for comparing the results for the several attempts;
a seventh program instruction for searching for the commonalities of failed attempts;
an eighth program instruction for marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts;
a ninth program instruction for providing an indication of a malware attempt if a predetermined number of failed attempts have accrued;
wherein said first, second, third, fourth, fifth, sixth, seventh, eighth, and ninth program instructions are stored on said non-transitory computer readable medium.

8 more elements

Dependencies are inferred from the claim text.

Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services

Life of this patent

Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services

Life of this patent

Abstract

Claims26