Back to results
US 11,457,022 B1Granted
Systems and methods for detecting malware domain names
AssigneeUnited Services Automobile Association (USAA)
InventorRobert Neel
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and methods of executing scanning software, such an executable software program or script (e.g., PowerShell script), by a computing device of an enterprise, such as a security server, may instruct the computing device to search all or a subset of computing devices in an enterprise network. The scanning software my identify PowerShell scripts containing particular malware attributes, according to a malicious-code dataset. The computing system executing the scanning software may scan through the identified PowerShell scripts to identify particular strings, values, or code-portions, and take a remedial action according to the scanning software programming.
Claims20
A server-implemented method comprising:
- receiving, by a server, a plurality of log files from a plurality of data sources configured to generate and store the plurality of log files, wherein each of the plurality of log files contains a domain name field associated with one of a plurality of domain names;
- parsing, by the server, the domain name field from data fields of each log file within the plurality of log files, wherein the data fields comprise information associated with a source or destination of data populated within a data record, the parsing including:
- comparing, by the server, domain names parsed from the plurality of log files to each other based on matching identical consecutive characters;
- identifying, by the server, non-identical yet equivalent domain names that each include an identical consecutive character pattern based on the comparison;
- and
- in response to identifying at least two non-identical domain names parsed from the data fields of the plurality of log files that include the identical consecutive character pattern,
- replace at least one of the at least two non-identical domain names in the domain names with a replacement unique domain name, wherein the replacement unique domain name is different than at least one of the at least two non-identical yet equivalent domain names;
- returning the replacement unique domain name that replaced the at least one of the at least two non-identical yet equivalent domain names;
- in response to receiving the returned replacement unique domain name, comparing the domain names, including the returned replacement unique domain names, parsed from the plurality of log files to each other to identify, by the server, a set of one or more unique domain names and eliminating duplicative domain names, wherein the duplicative domain names include at least one of the returned replacement unique domain names;
- disregarding at least one of the plurality of log files associated with the duplicative domain name;
- executing, by the server, a protocol to determine a credibility score for two or more of the one or more unique domain names based at least upon a length of each of the two or more unique domain names and a comparison of each of the two or more unique domain names with a domain name corpus stored in a dictionary database, the domain name corpus comprising a plurality of words;
- and
- in response to determining that the credibility score for a first domain name in the two or more unique domain names fails an acceptability threshold, updating, by the server, a blacklist record to include the first domain name, the blacklist record comprising a set of one or more blocked domain names.
10 more elements
A system comprising:
- a dictionary database comprising a domain name corpus, the domain name corpus comprising a plurality of words;
- a case management database storing a blacklist record comprising a set of one or more blocked domain names and a whitelist record comprising a set of one or more acceptable domain names;
- and
- a server configured to:
- receive a plurality of log files from a plurality of data sources configured to generate and store the plurality of log files, wherein each of the plurality of log files contains a domain name field associated with one of a plurality of domain names;
- parse the domain name field from data fields of each log file within the plurality of log files, wherein the data fields comprise information associated with a source or destination of data populated within a data record, the parsing including:
- compare, by the server, domain names parsed from the plurality of log files to each other based on matching identical consecutive characters;
- identify, by the server, non-identical yet equivalent domain names that each include an identical consecutive character pattern based on the comparison;
- and
- in response to identifying at least two non-identical domain names parsed from the data fields of the plurality of log files that include the identical consecutive character pattern,
- replace at least one of the at least two non-identical domain names in the domain names with a replacement unique domain name, wherein the replacement unique domain name is different than at least one of the at least two non-identical yet equivalent domain names;
- return the replacement unique domain name that replaced the at least one of the at least two non-identical yet equivalent domain names;
- in response to receiving the returned replacement unique domain name, compare the domain names, including the returned replacement unique domain names, parsed from the plurality of log files to each other to identify a set of one or more unique domain names and eliminate duplicative domain names, wherein the duplicative domain names include at least one of the returned replacement unique domain names;
- disregard at least one of the plurality of log files associated with the duplicative domain name;
- determine a credibility score for two or more of the one or more unique domain names based at least upon a length of each of the two or more unique domain names and a comparison of each of the two or more unique domain names with the domain name corpus;
- and
- in response to determining that the credibility score for a first domain name in the two or more unique domain names fails an acceptability threshold, update the blacklist record to include the first domain name.
14 more elements
Dependencies are inferred from the claim text.