Georgia Tech Research Corporation

Nick Feamster

Wenke Lee

Richard J Lipton

Anirudh Ramachandran

David Dagon

Robert Edmonds

A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Methods and systems for detecting compromised computers

Collect Domain Name System (DNS) data, the DNS data generated by a DNS server and/or similar device, wherein the DNS data comprises DNS queries, wherein the collected DNS data comprises DNS query rate information. Examine the collected DNS data relative to DNS data from known compromised and/or uncompromised computers. Determine an existence of the collection of compromised networks and/or computers, and/or an identity of compromised networks and/or computers, based on the examination.

Method and systems for detecting compromised networks and/or computers

Method and system for detecting and responding to attacking networks

Growing community of inventors

Atlanta, GA, United States of America

Nick Feamster