# US 10,484,422 B2 · Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,422 B2 - Document ID: US10484422B2 - Status: Granted - Kind: B2 - Application number: 15/296,700 - Filed: 2016-10-18 - Published: 2017-07-06 - Granted: 2019-11-19 - Earliest claimed: 2015-12-31 - Assignees: Cybereason Inc. - Applicants: Cybereason Inc. - Inventors: Uri Sternfeld; Yonatan Striem-Amit - Web page: https://patentgrep.com/patent/US10484422B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/554: {involving event detection and direct action} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 61/4511: using domain name system [DNS] - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued. ## Claims ### Claim 1 A method for the prevention of malware over an existing internet service, comprising: A) installing software on individual endpoints in a network, the software monitoring programs within the network and collecting information about where requests originated from, the software performing a method comprising: B) generating a random entry to an internet service; C) attempting to access the internet service with the random entry; D) detecting the indication of the internet service's non-accessibility for the random entry; E) repeating steps B) through D) one or more times; F) logging into the internet service if there is a successful attempt; G) comparing the results for the several attempts; H) searching for the commonalities of the failed attempts; I) marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts; J) providing an indication of a malware attempt if a predetermined number of failed attempts have accrued. ### Claim 2 (depends on 1) The method of claim 1, wherein the step of generating a random entry to the internet service further comprises the step of detecting differences between two existing access attempts to the internet service, taking the common part between the two requests as fixed and generating a noncommon part. ### Claim 3 (depends on 1) The method of claim 1, wherein the step of accessing the internet service with the random entry further comprises one or more from the list comprising: browsing to a webpage associated with the internet service, viewing a webpage associated with the internet service, searching for a internet service username, and emailing an account associated with the internet service to see if it exists. ### Claim 4 (depends on 1) The method of claim 1, wherein the step of detecting the indication of the internet service's non-accessibility further comprises the step of using a replay to take input and replay the input back using man in the middle. ### Claim 5 (depends on 1) The method of claim 1, wherein the step of comparing the results for the several attempts further comprises the step of finding the difference between the results using a desired distance function. ### Claim 6 (depends on 5) The method of claim 5, wherein the distance function is earth movers distance. ### Claim 7 (depends on 5) The method of claim 5, wherein the random entry used from each result is removed from the process of finding the distance. ### Claim 8 (depends on 1) The method of claim 1, wherein the commonalities comprise one or more from the list of: common elements which do not appear in successful attempts, and distances between the unsuccessful attempts. ### Claim 9 (depends on 1) The method of claim 1, wherein the accrual of failed attempts is temporal, logical, or statistical. ### Claim 10 (depends on 1) The method of claim 1, wherein the method first starts upon the occurrence of one or more from the following list: when an internet service is first accessed, when new domains are found, periodically or upon a statistical threshold being reached. ### Claim 11 (depends on 1) The method of claim 1, wherein the internet service is one or more from the following list: an email service, a tweet service, a phone service, an imaging service, and a videoconferencing service. ### Claim 12 (depends on 1) The method of claim 1, wherein the step of generating a random entry to the internet service further comprises the step of choosing the 90th percentile of similarity. ### Claim 13 A computer program product stored in a computer readable medium for prevention of malware over an existing internet service comprising: a non-transitory computer readable medium; a first program instruction for generating a random entry to an internet service; a second program instruction for attempting to access the internet service with the random entry; a third program instruction for detecting the indication of the internet service's non-accessibility for the random entry; a fourth program instruction_ or iterating the first, second and third program instructions a predetermined number of times; a fifth program instruction for logging into the internet service if there is a successful attempt; a sixth program instruction for comparing the results for the several attempts; a seventh program instruction for searching for the commonalities of failed attempts; an eighth program instruction for marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts; a ninth program instruction for providing an indication of a malware attempt if a predetermined number of failed attempts have accrued; wherein said first, second, third, fourth, fifth, sixth, seventh, eighth, and ninth program instructions are stored on said non-transitory computer readable medium. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the action of generating a random entry to the internet service further comprises the action of detecting differences between two existing access attempts to the internet service, taking the common part between the two requests as fixed and generating a unique noncommon part. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the action of accessing the internet service with the random entry further comprises one or more from the list comprising: browsing to a webpage associated with the internet service, viewing a webpage associated with the internet service, searching for an internet service username, and emailing an account associated with the internet service to see if it exists. ### Claim 16 (depends on 13) The computer program product of claim 13, wherein the action of detecting the indication of the internet service's non-accessibility further comprises the action of using a replay to take input and replay the input back using man in the middle. ### Claim 17 (depends on 13) The computer program product of claim 13, wherein the action of comparing the results for the several attempts further comprises the action of finding the difference between the results using a desired distance function. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the distance function is earth movers distance. ### Claim 19 (depends on 17) The computer program product of claim 17, wherein the random entry used from each result is removed from the process of finding the distance. ### Claim 20 (depends on 13) The computer program product of claim 13, wherein the commonalities comprise one or more from the list of: common elements which do not appear in successful attempts, and distances between the unsuccessful attempts. ### Claim 21 (depends on 13) The computer program product of claim 13, wherein the accrual of failed attempts is temporal, logical, or statistical. ### Claim 22 (depends on 13) The computer program product of claim 13, wherein the set of instructions of the computer program product first starts upon the occurrence of one or more from the following list: when an internet service is first accessed, when new domains are found, periodically or upon a statistical threshold being reached. ### Claim 23 (depends on 13) The computer program product of claim 13, wherein the internet service is one or more from the following list: an email service, a tweet service, a phone service, an imaging service, and a videoconferencing service. ### Claim 24 (depends on 13) The computer program product of claim 13, wherein the action of generating a random entry to the internet service further comprises the step of choosing the 90th percentile of similarity. ### Claim 25 A system for the prevention of malware over an existing internet service comprising: installed software on individual endpoints in a network, the software monitoring programs within the network and collecting information about where requests originated from, the software implementing a method comprising the steps of: A) generating a random entry to an internet service; B) attempting to access the internet service with the random entry; C) detecting the indication of the internet service's non-accessibility for the random entry; D) repeating steps A) through C) one ore more times; E) logging into the internet service if there is a successful attempt; F) comparing the results for the several attempts; G) searching for the commonalities of the failed attempts; H) marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts; I) providing an indication of a malware DGA attempt if a predetermined number of failed attempts have accrued. ### Claim 26 An apparatus having a processing unit and a storage device, the apparatus comprising: an entry generation component for A) generating a random entry to an internet service; an access component for B) attempting to access the internet service with the random entry; an accessibility detection component for C) detecting the indication of the internet service's non-accessibility for the random entry; an iteration component for D) repeating steps A) through C) one ore more times; a login component for E) logging into the internet service if there is a successful attempt; a comparison component for F) comparing the results for the several attempts; a search component for G) searching for the commonalities of the failed attempts; a marking component for H) marking a new attempt as a failed attempt when the new attempt is within the variance of the known failed attempts; an indication component for I) providing an indication of a malware DGA attempt if a predetermined number of failed attempts have accrued.