Georgia Tech Research Corporation

Damballa, Inc.

David Dagon

Wenke Lee

Richard J Lipton

Anirudh Ramachandran

Nick Feamster

Robert Edmonds

Roberto Perdisci

Manos Antonakakis

A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Methods and systems for detecting compromised computers

A system and method for determining whether at least one domain is legitimate or malicious by obtaining passive DNS query information, using the passive DNS query information to measure statistical features of known malicious domain names and known legitimate domain names, and using the statistical features to determine at least one reputation for at least one new domain, where the reputation indicates whether the at least one new domain is likely to be for malicious or legitimate uses.

Method and system for determining whether domain names are legitimate or malicious

Collect Domain Name System (DNS) data, the DNS data generated by a DNS server and/or similar device, wherein the DNS data comprises DNS queries, wherein the collected DNS data comprises DNS query rate information. Examine the collected DNS data relative to DNS data from known compromised and/or uncompromised computers. Determine an existence of the collection of compromised networks and/or computers, and/or an identity of compromised networks and/or computers, based on the examination.

Method and systems for detecting compromised networks and/or computers

Method and system for detecting and responding to attacking networks

Growing community of inventors

Tampa, FL, United States of America

David Dagon