Back to results
US 11,888,879 B2Granted
System and method for monitoring security of a computer network
AssigneeCognyte Technologies Israel Ltd.
InventorsYitshak Yishay, Vadim Pogulievsky
Life of this patent
Estimating the term…
Abstract
Methods and systems to identify the domain names that can potentially be used for delivering instructions to a bot, before bots on a computer network succeed in obtaining the instructions. The system maintains a device rating for each device that reflects a likelihood that the device is infected by malware. The system also maintains a domain-name rating for each device that reflects a likelihood that the domain name is malicious. When a device attempts to access a particular domain name, the domain-name rating of the domain name is updated in light of the device rating of the device, and/or update the device rating of the device in light of the domain-name rating.
Claims20
A method for monitoring security of a computer network, the method comprising:
- identifying one or more attempted accesses from computing devices of the computer network to respective Internet-resource identifiers in an external network,
- each of the Internet-resource identifiers having a respective Internet-resource-identifier rating that reflects a likelihood that one of a plurality of the Internet-resource identifiers is malicious, and
- each of the computing devices having a respective device rating that reflects a likelihood that the computing device is infected by malware;
- updating, based on the Internet-resource-identifier rating, the device rating of a respective one of the computing devices when the respective one of the computing devices attempts to access one of the plurality of Internet resources;
- updating, based on the device rating, the Internet-resource-identifier rating of a respective one of the Internet resource identifiers when a respective one the computing devices attempts to access the respective one of the Internet resource identifiers, wherein the Internet-resource identifier rating of the respective one of the Internet resource identifiers is not assigned if the respective Internet-resource identifier is known to be non-malicious;
- updating one or more of the device ratings in response to one or more failed Domain Name System (DNS) queries, based on at least one of the following;
- (i) a number of the failed DNS queries, (ii) a frequency of the failed DNS queries, or (iii) both the number and the frequency of the failed DNS queries, originating from the computing devices to which the one or more device ratings, respectively, belong;
- and
- in response to at least one of the device ratings and Internet-resource-identifier ratings, ascertaining that the security of the computer network has been compromised, and generating an output in response thereto.
6 more elements
Apparatus for monitoring security of a computer network, the apparatus comprising:
- a network interface;
- and
- a hardware processor, configured to:
- via the network interface, identify one or more attempted accesses from the computer network to respective Internet-resource identifiers in an external network by respective computing devices comprised within the computer network,
- each of the Internet-resource identifiers having a respective Internet-resource-identifier rating that reflects a likelihood that one of a plurality of the Internet-resource identifiers is malicious, and
- each of the computing devices having a respective device rating that reflects a likelihood that the computing device is infected by malware;
- update, based on the Internet-resource-identifier rating, the device rating of a respective one of the computing devices when the respective one of the computing devices attempts to access one of the plurality of Internet resources;
- update, based on the device rating, the Internet-resource-identifier rating of a respective one of the Internet resource identifiers when a respective one the computing devices attempts to access the respective one of the Internet resource identifiers, wherein the Internet-resource identifier rating of the respective one of the Internet resource identifiers is not assigned if the respective Internet-resource identifier is known to be non-malicious;
- update one or more of the device ratings in response to one or more failed Domain Name System (DNS) queries, based on at least one of the following;
- (i) a number of the failed DNS queries, (ii) a frequency of the failed DNS queries, or (iii) both the number and the frequency of the failed DNS queries, originating from the computing devices to which the one or more device ratings, respectively, belong;
- and
- in response to at least one of the device ratings and Internet-resource-identifier ratings, ascertaining that the security of the computer network has been compromised, and generating an output in response thereto.
9 more elements
A computer software product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, said program instructions, when read by a processor, cause the processor to:
- identify one or more attempted accesses from a computer network to respective Internet-resource identifiers in an external network by respective computing devices comprised within the computer network,
- each of the Internet-resource identifiers having a respective Internet-resource-identifier rating that reflects a likelihood that one of a plurality of the Internet-resource identifiers is malicious, and
- each of the computing devices having a respective device rating that reflects a likelihood that the computing device is infected by malware;
- update, based on the Internet-resource-identifier rating, the device rating of a respective one of the computing devices when the respective one of the computing devices attempts to access one of the plurality of Internet resources;
- update, based on the device rating, the Internet-resource-identifier rating of a respective one of the Internet resource identifiers when a respective one the computing devices attempts to access the respective one of the Internet resource identifiers, wherein the Internet-resource identifier rating of the respective one of the Internet resource identifiers is not assigned if the respective Internet-resource identifier is known to be non-malicious;
- update one or more of the device ratings in response to one or more failed Domain Name System (DNS) queries, based on at least one of the following;
- (i) a number of the failed DNS queries, (ii) a frequency of the failed DNS queries, or (iii) both the number and the frequency of the failed DNS queries, originating from the computing devices to which the one or more device ratings, respectively, belong;
- and
- in response to at least one of the device ratings and Internet-resource-identifier ratings, ascertaining that the security of the computer network has been compromised, and generating an output in response thereto.
6 more elements
Dependencies are inferred from the claim text.