Back to results
US 9,807,110 B2Granted
Method and system for detecting algorithm-generated domains
AssigneeVectra Networks, Inc.
InventorsJames Patrick Harlacher, Aditya Sood, Oskar Ibatullin
Life of this patent
Estimating the term…
Abstract
A method and system for detecting algorithm-generated domains (AGDs) is disclosed wherein domain names requested by an internal host are categorized or classified using curated data sets, active services (e.g. Internet services), and certainty scores to match domain names to domain names or IP addresses used by command and control servers.
Claims27
A computer-implemented method for detecting algorithm-generated domains (AGDs), the method comprising:
- monitoring traffic within an organization's internal network, the internal network communicating with an external network through a border device, a flow preprocessor engine analyzing one or more requested domain names to identify algorithm generated domains corresponding to communications sent by an internal network client within the internal network, wherein the flow preprocessor engine is located inside the internal network;
- identifying whether the one or more requested domain names correspond to potential algorithm generated domains;
- determining whether the one or more requested domain names that correspond to potential algorithm generated domains exists;
- categorizing the one or more requested domain names that exists using one or more curated datasets to generate domain name categorization data;
- assigning the one or more requested domain names that exists to one or more bucket data structures;
- assigning analysis point data values that correspond to the one or more requested domain names that exists to the one or more bucket data structures based at least in part on domain name categorization data;
- and
- generating reporting data that the one or more requested domain names that exists indicates AGD if the analysis point data values assigned to the one or more bucket data structures exceed a threshold value.
5 more elements
A system for detecting algorithm-generated domains, comprising:
- a computer processor to execute a set of program code instructions;
- a memory to hold the program code instructions, in which the program code instructions comprises program code to perform:
- monitoring traffic within an organization's internal network, the internal network communicating with an external network through a border device, a flow preprocessor engine analyzing one or more requested domain names to identify algorithm generated domains corresponding to communications sent by an internal network client within the internal network, wherein the flow preprocessor engine is located inside the internal network;
- identifying whether the one or more requested domain names correspond to potential algorithm generated domains;
- determining whether the one or more requested domain names that correspond to potential algorithm generated domains exists;
- categorizing-one or more requested domain names that exists using one or more curated datasets to generate domain name categorization data;
- assigning the one or more requested domain names that exists to one or more bucket data structures;
- assigning analysis point data values that correspond to the one or more requested domain names that exists to the one or more bucket data structures based at least in part on domain name categorization data;
- and
- generating reporting data that the one or more requested domain names that exists indicates AGD if the analysis point data values assigned to the one or more bucket data structures exceeds a threshold value.
7 more elements
A computer program product embodied on a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for detecting algorithm-generated domains (AGDs), the method comprising:
- monitoring traffic within an organization's internal network, the internal network communicating with an external network through a border device, a flow preprocessor engine analyzing one or more requested domain names to identify algorithm generated domains corresponding to communications sent by an internal network client within the internal network, wherein the flow preprocessor engine is located inside the internal network;
- identifying whether the one or more requested domain names correspond to potential algorithm generated domains;
- determining whether the one or more requested domain names that correspond to potential algorithm generated domains exists;
- categorizing one or more requested domain names that exists using one or more curated datasets to generate domain name categorization data;
- assigning the one or more requested domain names that exists to one or more bucket data structures;
- assigning analysis point data values that correspond to the one or more requested domain names that exists to the one or more bucket data structures based at least in part on domain name categorization data;
- and
- generating reporting data that the one or more requested domain names that exists indicates AGD if the analysis point data values assigned to the one or more bucket data structures exceeds a threshold value.
5 more elements
Dependencies are inferred from the claim text.