Patent ID: 11902305
Assignee: CHARTER COMMUNICATIONS OPERATING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 19:
20. A system for botnet detection and mitigation comprising:
a memory; and
at least one processor, coupled to said memory, and operative to perform operations comprising:
obtaining threat information, the threat information identifying one or more indicators of compromise (IOC) corresponding to suspected or known malicious network traffic;
generating a control list (CL) corresponding to the threat information, the CL describing rules for identifying network flows to be logged in a network log;
obtaining the network log identifying the network flows;
identifying a suspect network flow identified by both the threat information and the network log;
identifying an address corresponding to the suspect network flow;
correlating the address corresponding to the suspect network flow, the suspect network flow being generated in response to a bot control network flow, with an identifier of an infected device that is sending the suspect network flow; and
mitigating a malicious bot based on the identifier.