Detection of malware using time spans and periods of activity for network requests

Patent metadata

Field	Value
Publication number	US-9692772-B2
Application number	US-201615018758-A
Country	US
Kind code	B2
Filing date	Feb 8, 2016
Priority date	Mar 26, 2014
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

First claim

What is claimed is:

1. A method of identifying machines infected by malware, performed by a security monitoring computing device, the method comprising:
tracking domain names in network requests from a computing device, the tracking occurring over a first time span;
receiving a fully qualified domain name relating to a network request from the computing device;
determining whether the fully qualified domain name is among the tracked domain names and whether the fully qualified domain name was visited during a more recent second time span;
indicating the computing device has a likelihood of infection, responsive to a result of the determining;
determining whether the fully qualified domain name exceeds a predetermined length; and
elevating a level of suspicion of the computing device responsive to the result of the determining whether the fully qualified domain name exceeds a predetermined length.

2. The method of claim 1 , wherein tracking the domain names includes adding the fully qualified domain name, along with a timestamp, to a list of tracked domain names.

3. The method of claim 1 , further comprising:
adding the computing device to a list of computing devices suspected of infection by malware, responsive to the result of the determining.

4. The method of claim 1 , further comprising:
further determining whether the computing device has issued a plurality of network requests greater in number than a specified value, each of the plurality of network requests including the fully qualified domain name, during the second time span; and
elevating a level of suspicion of the computing device responsive to the result of the further determining.

5. The method of claim 1 , further comprising:
determining whether the fully qualified domain name includes a reference to a country that is anomalous to the computing device per the tracking
elevating a level of suspicion of the computing device responsive to the result of the determining whether the fully qualified domain name includes a reference to a country that is anomalous to the computing device per the tracking.

Assignees

• Symantec Corp

Inventors

• Hart Michael
• Kienzle Darrell
• Ashley Peter

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• H04L63/14 Primary

  for detecting or protecting against malicious traffic · CPC title