# US 11,005,779 B2 · Method of and server for detecting associated web resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,005,779 B2 - Document ID: US11005779B2 - Status: Granted - Kind: B2 - Application number: 16/270,341 - Filed: 2019-02-07 - Published: 2019-08-15 - Granted: 2021-05-11 - Earliest claimed: 2018-02-13 - Assignees: Trust Ltd. - Applicants: Trust Ltd. - Inventors: Dmitry Aleksandrovich Volkov; Philipp Alekseevich Mileshin - Web page: https://patentgrep.com/patent/US11005779B2 ## CPC - H04L 47/781: {Centralised allocation of resources} - G06N 20/00: Machine learning - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/045: for graphical visualisation of monitoring data - H04L 47/786: {Mapping reservation between domains} - H04L 47/803: {Application aware} - H04L 47/82: {Miscellaneous aspects} - H04L 47/822: {Collecting or measuring resource availability data} - H04L 47/826: {Involving periods of time} - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/166: {at the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method of determining associated network resources from a plurality of network resources available on a network, the method executable by a server that is communicatively coupled to the network. The method comprises: scanning, by the server, the network to identify a first network resource and a second network resource of the plurality of network resources; retrieving, by the server, information associated with the first network resource and the second network resource, the information comprising at least one parameter of the first network resource and at least one parameter of the second network resource; in response to a match between the at least one parameter of the first network resource and at least one parameter of the second network resource, determining a connection between the first network resource and the second network resource. ## Claims ### Claim 1 A method of determining affiliation of network resources with a malicious infrastructure on a network, the method being executable by a server that is communicatively coupled to the network, the method comprising: scanning, by the server, the network to identify a plurality of network resources; retrieving, by the server, information associated with each one of the plurality of network resources, the information associated with a given one of the plurality of network resources comprising at least one respective parameter thereof; identifying, by the server, in the plurality of network resources, based on the information associated with each one of the plurality of network resources, network resources having respective parameters matching the at least one respective parameter of the given one of the plurality of network resources, thereby generating network resources, the first subset of network resources potentially being affiliated with a respective malicious infrastructure; determining, by the server, a number of network resources in the first subset of network resources; calculating, based on the number of resources in the first subset of network resources, for the at least one respective parameter, a first connection weight, the first connection weight being indicative of a quality value associated with the at least one respective parameter being an unambiguously characterizing indicator of the network resources having been grouped into the first subset of network resources by the at least one respective parameter being affiliated with the respective malicious infrastructure; the first connection weight associated with the at least one respective parameter being inversely proportional to the number of network resources in the first subset of network resources, such that: the fewer the number of network resources in the first subset of network resources is, the greater the first connection weight is; in response to the first connection weight being greater than or equal to a predetermined threshold value: identifying, based on the at least one respective parameter, the first subset of network resources as being affiliated with the respective malicious infrastructure in the network; storing, by the server, data indicative of the at least one respective parameter in a database of network resources; and using, by the server, the data indicative of the at least one respective parameter for analyzing other network resources on the network for affiliation thereof with an other malicious infrastructure. ### Claim 2 (depends on 1) The method of claim 1, wherein the method further comprises evaluating an actual time interval as the at least one respective parameter. ### Claim 3 (depends on 1) The method of claim 1, wherein the method further comprises: obtaining additional information associated with the given one of the plurality of network resources from a history database; and wherein the matching between the at least one respective parameter of the given one of the plurality of network resources and the respective parameters of each one of the first subset of network resources is established based on the additional information from the history database. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one respective parameter comprises at least one of: a domain name, an IP-address, an SSL-key, an SSH-fingerprint, an executable file, information about running services, a domain name owner data, an IP-address owner data, an e-mail address, and resource owner contact information. ### Claim 5 (depends on 1) The method of claim 1, wherein the at least one respective parameter has at least one value. ### Claim 6 (depends on 1) The method of claim 1, further comprising determining respective connections among the first subset of network resources, based on the at least one respective parameter, by applying a mathematical model in a form of a graph, graph vertices respectively corresponding to each one of the first subset of network resources, and graph edges representing the respective connections thereamong. ### Claim 7 (depends on 1) The method of claim 1, wherein the predetermined threshold value is set by the user. ### Claim 8 (depends on 1) The method of claim 1, wherein the predetermined threshold value is set using a machine learning algorithm. ### Claim 9 (depends on 1) The method of claim 1, wherein the first connection weight is further based on a date and time associated with at least part of the information associated with each one of the plurality of network resources. ### Claim 10 (depends on 1) The method of claim 1, wherein the at least one respective parameter is associated with a first parameter weight, and the first connection weight is directly proportional to the first parameter weight. ### Claim 11 A server for determining affiliation of network resources with a malicious infrastructure on a network, the server being configured to connect to a database via the network, the server comprising: a data transmission interface for data exchange via the network; a memory storing machine-readable instructions; a processor, functionally coupled to the data transmission interface and the memory, wherein the processor, upon executing the machine-readable instructions, being configured to: scan the network to identify a plurality of network resources; retrieve information associated with each one of the plurality of network resources, the information associated with a given one of the plurality of network resources comprising at least one respective parameter thereof; identify, in the plurality of network resources, based on the information associated with each one of the plurality of network resources, network resources having respective parameters matching the at least one respective parameter of the given one of the plurality of network resources, thereby generating network resources, the first subset of network resources potentially being affiliated with a respective malicious infrastructure; determine a number of network resources in the first subset of network resources; calculate, based on the number of resources in the first subset of network resources, for the at least one respective parameter, a first connection weight, the first connection weight being indicative of a quality value associated with the at least one respective parameter being an unambiguously characterizing indicator of the network resources having been grouped into the first subset of network resources by the at least one respective parameter being affiliated with the respective malicious infrastructure; the first connection weight associated with the at least one respective parameter being inversely proportional to the number of network resources in the first subset of network resources, such that: the fewer the number of network resources in the first subset of network resources is, the greater the first connection weight is; in response to the first connection weight being greater than or equal to a predetermined threshold value: identify, based on the at least one respective parameter, the first subset of network resources as being affiliated with the respective malicious infrastructure in the network; store data indicative of the at least one respective parameter in a database of network resources; and use the data indicative of the at least one respective parameter for analyzing other network resources on the network for affiliation thereof with an other malicious infrastructure; in response to the first connection weight being less than the predetermined threshold value, not identify the first subset of network resources as being affiliated with the respective malicious infrastructure. ### Claim 12 (depends on 1) The method of claim 1, wherein, in response to the first connection weight being less than the predetermined threshold value, the method further comprises not identifying, based on the at least one respective parameter, the first subset of network resources as being affiliated with the respective malicious infrastructure.