The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Nov. 17, 2020

Filed:

Jul. 23, 2019
Applicant:

International Business Machines Corporation, Armonk, NY (US);

Inventors:

Xin Hu, White Plains, NY (US);

Jiyong Jang, White Plains, NY (US);

Douglas Lee Schales, Ardsley, NY (US);

Marc Philippe Stoecklin, White Plains, NY (US);

Ting Wang, White Plains, NY (US);

Attorneys:
Primary Examiner:
Int. Cl.
CPC ...
G06F 21/56 (2013.01); G06F 21/55 (2013.01); H04L 29/06 (2006.01); H04L 29/12 (2006.01); G06F 21/57 (2013.01);
U.S. Cl.
CPC ...
H04L 63/1408 (2013.01); G06F 21/55 (2013.01); G06F 21/552 (2013.01); G06F 21/566 (2013.01); H04L 61/1511 (2013.01); H04L 63/145 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01); G06F 21/577 (2013.01);
Abstract

A command endpoint used by Domain Generation Algorithm (DGA) malware is identified using machine learning-based clustering. According to this technique, at least one attribute associated with a candidate resolved DNS name is identified. The candidate resolved DNS name has associated therewith a set of names that are failed DNS lookups but that cluster with the candidate resolved DNS name. A set of additional names that share the at least one attribute with the candidate resolved DNS name are then identified. For the set of additional names, an extent to which the set of additional names also clusters with the set of names that are failed DNS lookups is then determined. The candidate resolved DNS name is characterized as associated with the command endpoint when the set of additional names cluster with the set of names that are failed DNS lookups to a configurable degree.


Find Patent Forward Citations

Loading…