Patent ID: 11876808
Assignee: ARBOR NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:
monitor network traffic from a plurality of internal production systems of a protected network for domain names;
determine, for each internal production system of the plurality of internal production systems over the course of a long time interval, a first collection of domain names that are output by the internal production system;
determine, for each internal production system of the plurality of internal production systems over the course of a short time interval, a second collection of domain names that are output by the internal production system, the short time interval subsequent to the long time interval;
compare, for each internal production system of the plurality of internal production systems, the domain names in the first collection with the domain names in the second collection;
identify one or more internal production systems of the plurality of internal production systems for which one or more domain names are included in the domain names in the second collection and are absent from the domain names in the first collection;
determine that one or more domain names are suspicious domain names when it is determined that a number of the one or more internal production systems satisfies a threshold number of internal production systems; and
treat the one or more domain names as suspicious.