# US 2019/0319979 A1 · Systems and methods for external detection of misconfigured systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319979 A1 - Document ID: US20190319979A1 - Status: Published application - Kind: A1 - Application number: 15/954,921 - Filed: 2018-04-17 - Published: 2019-10-17 - Earliest claimed: 2018-04-17 - Assignees: BitSight Technologies, Inc. - Applicants: BitSight Technologies, Inc. - Inventors: Joao Gouveia - Web page: https://patentgrep.com/patent/US20190319979A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 61/302: {Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]} - H04L 61/4511: using domain name system [DNS] - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method is provided for external detection of a vulnerable system coupled to a communication network. The method can include measuring communication traffic on the communication network to identify one or more domain names, which in turn can originate from server systems in the communication network. The method can further include identifying the domain names based on metadata from the domain names and/or the measured communication traffic, where each domain name has an associated property indicative of its vulnerability. The method can further include determining whether any one (or more) of the domain names is registered at a domain name registry and, if the domain name is not registered, registering the domain name. ## Claims ### Claim 1 A computer-implemented method for external detection of a vulnerable system, the vulnerable system coupled to a communication network, the method comprising: monitoring communication traffic in the communication network to identify one or more domain names, the communication traffic originating from one or more server systems in the communication network; executing queries on the communication traffic to extract metadata while monitoring the communication traffic; identifying the one or more domain names based on the metadata, each domain name having a property indicative of vulnerability, the metadata comprising a geographical location associated with each identified domain name; determining whether each domain name, of the one or more domain names, is registered at a domain name registry; and if the domain name is not registered, registering the domain name based on a high frequency of domain names having a property indicative of vulnerability in a particular geographical location. ### Claim 2 (depends on 1) The method of claim 1, wherein each domain name having the property indicative of vulnerability is at least one selected from the group consisting of: (i) an unregistered domain name, (ii) a misconfigured domain name, (iii) an abandoned domain name, and (iv) an algorithm-generated domain name. ### Claim 3 (depends on 1) The method of claim 1, wherein the vulnerable system is a malware-infected server system. ### Claim 4 (depends on 1) The method of claim 1, wherein the vulnerable system is a misconfigured server system. ### Claim 5 (canceled) ### Claim 6 (depends on 1) The method of claim 1, further comprising: associating the registered domain name with a server system configured to monitor communication traffic to the registered domain name. ### Claim 7 (depends on 1) The method of claim 1, further comprising: detecting the vulnerable system associated with the registered domain name. ### Claim 8 (depends on 1) The method of claim 1, wherein monitoring communication traffic to identify one or more domain names further comprises: receiving communication traffic data from one or more Internet service providers (ISP). ### Claim 9 (depends on 1) The method of claim 1, wherein monitoring communication traffic to identify one or more domain names further comprises: comparing relative magnitude of communication traffic to an expected amount of traffic. ### Claim 10 (depends on 1) The method of claim 1, wherein monitoring communication traffic to identify one or more domain names further comprises: measuring a frequency of communication traffic to the domain name. ### Claim 11 A system comprising: one or more computer systems programmed to perform operations comprising: monitoring communication traffic in the communication network to identify one or more domain names, the communication traffic originating from one or more server systems in the communication network; executing queries on the communication traffic to extract metadata while monitoring the communication traffic; identifying the one or more domain names based on the metadata, each domain name having a property indicative of vulnerability, the metadata comprising a geographical location associated with each identified domain name; determining whether each domain name, of the one or more domain names, is registered at a domain name registry; and if the domain name is not registered, registering the domain name based on a high frequency of domain names having a property indicative of vulnerability in a particular geographical location. ### Claim 12 (depends on 11) The system of claim 11, wherein each domain name having the property indicative of vulnerability is at least one selected from the group consisting of: (i) an unregistered domain name, (ii) a misconfigured domain name, (iii) an abandoned domain name, and (iv) an algorithm-generated domain name. ### Claim 13 (depends on 11) The system of claim 11, wherein the vulnerable system is a malware-infected server system. ### Claim 14 (depends on 11) The system of claim 11, wherein the vulnerable system is a misconfigured server system. ### Claim 15 (canceled) ### Claim 16 (depends on 11) The system of claim 11, wherein the operations further comprise: associating the registered domain name with a server system configured to monitor communication traffic to the registered domain name. ### Claim 17 (depends on 11) The system of claim 11, wherein the operations further comprise: detecting the vulnerable system associated with the registered domain. ### Claim 18 (depends on 11) The system of claim 11, wherein monitoring communication traffic to identify one or more domain names further comprises: receiving communication traffic data from one or more Internet service providers (ISP). ### Claim 19 (depends on 11) The system of claim 11, wherein monitoring communication traffic to identify one or more domain names further comprises: comparing relative magnitude of communication traffic to an expected amount of traffic. ### Claim 20 (depends on 11) The system of claim 11, wherein monitoring communication traffic to identify one or more domain names further comprises: measuring a frequency of communication traffic to the domain name. ### Claim 21 (depends on 1) The method of claim 1, wherein the metadata comprises at least one of the group consisting of: (a) geographical location of the communication traffic, (b) frequency of the communication traffic, (c) magnitude of the communication traffic, (d) aggregated counters of a number of unique Internet Protocol (IP) addresses per country, (e) a number of events observed per period, and (f) a ratio of unique IP addresses to a sum of a portion of the communication traffic. ### Claim 22 (depends on 11) The system of claim 11, wherein the metadata comprises at least one of the group consisting of: (a) geographical location of the communication traffic, (b) frequency of the communication traffic, (c) magnitude of the communication traffic, (d) aggregated counters of a number of unique Internet Protocol (IP) addresses per country, (e) a number of events observed per period, and (f) a ratio of unique IP addresses to a sum of a portion of the communication traffic.