Systems and methods of identifying suspicious hostnames
AssigneeCloudmark, Inc.
InventorsMark Richard Stemm, Arlyn Robert Johns
Life of this patent
Estimating the term…
Abstract
A method includes receiving a set of strings and applying one or more filters to generate a subset of strings that are determined to correspond to strings of interest. The method also includes retrieving domain name system (DNS) information associated with a first string of the subset. The method includes executing a rule-based engine to determine, based on application of one or more rules to the DNS information, whether to add the first string to a set of suspicious hostnames.
Claims20
A method comprising:
- receiving, via an input interface, a string that corresponds to a hostname;
- identifying, at a computing device, a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings;
- and
- applying, at the computing device, a filter to determine whether to classify the string as potentially suspicious, the filter including an entropy filter and at least one other filter, wherein the filter is configured to classify the string as potentially suspicious in response to the entropy filter and the at least one other filter each indicating that the string is potentially suspicious, wherein the entropy filter is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string.
A computer-readable storage device comprising instructions that, when executed by a computer, cause the computer to perform operations comprising:
- identifying a string received via an input interface of the computer, wherein the string corresponds to a hos tname;
- identifying a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set of strings;
- and
- applying a filter operation to determine whether to classify the string as potentially suspicious, the filter operation including an entropy filter operation and at least one other filter operation, wherein the filter operation is configured to classify the string as potentially suspicious in response to the entropy filter operation and the at least one other filter operation each indicating that the string is potentially suspicious, wherein the entropy filter operation is configured to indicate that the string is potentially suspicious based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string.
A system comprising:
- a memory configured to store a set of potentially suspicious strings;
- a processor;
- and
- a filtering module executable by the processor to:
- receive a string that corresponds to a hostname;
- identify a data structure that indicates frequencies of occurrence of each of a plurality of n-grams in a first set strings;
- apply a filter to determine whether to add the string to the set of potentially suspicious strings, the filter including an entropy filter and at least one other filter, wherein the filter is configured to add the string to the set of potentially suspicious strings in response to the entropy filter and the at least one other filter each indicating that the string is potentially suspicious, wherein the entropy filter configured to indicate that the string is potentially suspicious strings based on an n-gram entropy of the string, and wherein the n-gram entropy of the string is a function of the frequency of occurrence, indicated by the data structure, for each n-gram in the string.
Dependencies are inferred from the claim text.