Methods and systems for prioritizing the monitoring of malicious uniform resource locators for new malware variants

A computing system for prioritizing the monitoring of malicious uniform resource locators for new malware variants, the system comprising:

• a memory for storing a monitoring module;
• a processor in communication with the memory, the processor executes the monitoring module to:
• identify a plurality of malicious uniform resource locators, wherein each malicious uniform resource locator within the malicious uniform resource locators has previously pointed to a corresponding malware sample;
• collect priority information for each of the malicious uniform resource locators to determine a non-zero and non-one probability that each of the malicious uniform resource locators will point to a new malware sample that is distinct from the corresponding malware sample previously pointed to by the malicious uniform resource locator;
• assign a monitoring-priority level to each malicious uniform resource locator that monotonically increases with the probability that the malicious uniform resource locator will point to a new malware sample that is distinct from the corresponding malware sample previously pointed to by the malicious uniform resource locator, wherein assigning the monitoring-priority level optionally comprises modifying the monitoring-priority level with a manual-adjustment number;
• allocate an amount of monitoring resources for monitoring the malicious uniform resource locator for new malware samples based on the monitoring-priority level;
• monitor each malicious uniform resource locator for new malware samples using the amount of monitoring resources allocated for monitoring the malicious uniform resource locator based on the monitoring-priority level, wherein at least one lower-priority malicious uniform resource locator within the malicious uniform resource locators is monitored for new malware samples using an amount of monitoring resources that is less than an amount of monitoring resources allocated to monitoring a higher-priority malicious uniform resource locator within the malicious uniform resource locators.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:

• identify a plurality of malicious uniform resource locators, wherein each malicious uniform resource locator within the malicious uniform resource locators has previously pointed to a corresponding malware sample;
• collect priority information for each of the malicious uniform resource locators to determine a non-zero and non-one probability that each of the malicious uniform resource locators will point to a new malware sample that is distinct from the corresponding malware sample previously pointed to by the malicious uniform resource locator;
• assign a monitoring-priority level to each malicious uniform resource locator that is monotonically increases with the probability that the malicious uniform resource locator will point to a new malware sample that is distinct from the corresponding malware sample previously pointed to by the malicious uniform resource locator, wherein assigning the monitoring-priority level optionally comprises modifying the monitoring-priority level with a manual-adjustment number;
• allocate an amount of monitoring resources for monitoring the malicious uniform resource locator for new malware samples based on the monitoring-priority level;
• monitor each malicious uniform resource locator for new malware samples using the amount of monitoring resources allocated for monitoring the malicious uniform resource locator based on the monitoring-priority level, wherein at least one lower-priority malicious uniform resource locator within the malicious uniform resource locators is monitored for new malware samples using an amount of monitoring resources that is less than an amount of monitoring resources allocated to monitoring a higher-priority malicious uniform resource locator within the malicious uniform resource locators.