Methods and systems for identifying malware enabled by automatically generated domain names
AssigneeCheck Point Software Technologies Ltd.
InventorAliaksandr CHAILYTKO
Life of this patent
Estimating the term…
Abstract
Computerized methods and systems identify malware enabled by automatically generated domain names. An agent executes a malware, in a controlled environment, at a first temporal input value and a second temporal input value. A first set of domain names is generated in response to the execution at the first temporal input value. A second set of domain names is generated in response to the execution at the second temporal input value. The agent compares the first set of domain names with the second set of domain names to produce a comparison output metric.
Claims20
A method for identifying malware enabled by automatically generated domain names, comprising:
- executing a malware, in a controlled environment, at a first temporal execution input value and a second temporal execution input value;
- and
- comparing a first set of domain names, generated in response to the execution at the first temporal execution input value, with a second set of domain names, generated in response to the execution at the second temporal execution input value, to produce a comparison output metric.
A computer system for identifying malware enabled by automatically generated domain names, comprising:
- a storage medium for storing computer components;
- and
- a computerized processor for executing the computer components in a controlled environment comprising:
- a computer module configured for:
- executing a malware at a first temporal execution input value and a second temporal execution input value;
- and
- comparing a first set of domain names generated in response to the execution at the first temporal execution input value with a second set of domain names generated in response to the execution at the second temporal execution input value to produce a comparison output metric.
A method for identifying malware enabled by automatically generated domain names, comprising:
- generating a first set of domain names in response to execution of a malware, in a controlled environment, at a first temporal input value;
- generating a second set of domain names in response to execution of the malware, in the controlled environment, at a second temporal input value that is subsequent from the first temporal input value;
- and
- comparing the first set of domain names with the second set of domain names to produce a comparison output metric.
Dependencies are inferred from the claim text.