Georgia Tech Research Corporation

At&t Intellectual Property I, L.p.

Anirudh Ramachandran

Wenke Lee

Richard J Lipton

David Dagon

Nick Feamster

Robert Edmonds

Oliver Spatscheck

Jacobus Erasmus Van Der Merwe

Balachander Krishnamurthy

Nicholas G Feamster

Muhammad Mukarram Bin Tariq

Yogesh H Mundada

A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Methods and systems for detecting compromised computers

Collect Domain Name System (DNS) data, the DNS data generated by a DNS server and/or similar device, wherein the DNS data comprises DNS queries, wherein the collected DNS data comprises DNS query rate information. Examine the collected DNS data relative to DNS data from known compromised and/or uncompromised computers. Determine an existence of the collection of compromised networks and/or computers, and/or an identity of compromised networks and/or computers, based on the examination.

Method and systems for detecting compromised networks and/or computers

Disclosed are embodiments of a security system for reducing data leaks by checking information flows between resources of a network. When an information flow is attempted between a sending resource, which can be anywhere in the network, and a receiving resource residing at a specific host within the network, a host labeler can determine whether information is allowed to flow from the sending resource to the receiving resource. The sending resource and the receiving resource can each have an applicable label, and each label can comprise zero, one, or more taints. For each taint having an active secrecy characteristic in a label of the sending resource, the host labeler can require that there be a matching taint with active secrecy characteristic in the receiving resource. If this condition is not met, the security system can block the information flow between the sending and receiving resources.

Security systems and methods to reduce data leaks in enterprise networks

According to an aspect of this invention, a method to detect phishing URLs involves: creating a whitelist of URLs using a first regular expression; creating a blacklist of URLs using a second regular expression; comparing a URL to the whitelist; and if the URL is not on the whitelist, comparing the URL to the blacklist. False negatives and positives may be avoided by classifying Internet domain names for the target organization as 'legitimate'. This classification leaves a filtered set of URLs with unknown domain names which may be more closely examined to detect a potential phishing URL. Valid domain names may be classified without end-user participation.

Method and apparatus for identifying phishing websites in network traffic using generated regular expressions

Method and system for detecting and responding to attacking networks

Growing community of inventors

Atlanta, GA, United States of America

Anirudh Ramachandran