# US 2014/0157414 A1 · Method and system for detecting malicious domain names at an upper dns hierarchy

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157414 A1
- Document ID: US20140157414A1
- Status: Published application
- Kind: A1
- Application number: 14/096,803
- Filed: 2013-12-04
- Published: 2014-06-05
- Earliest claimed: 2011-02-01
- Assignees: Damballa, Inc.
- Applicants: Damballa, Inc.
- Inventors: Manos ANTONAKAKIS; Roberto PERDISCI; Wenke LEE; Nikolaos VASILOGLOU, II
- Web page: https://patentgrep.com/patent/US20140157414A1

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 61/4511: using domain name system [DNS]
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and system for detecting a malicious domain name, comprising: collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.

## Claims

### Claim 1

A method for detecting a malicious domain name, comprising:
performing processing associated with collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and
performing processing associated with utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.