Patent ID: 11956257
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 7:
8. A computer program product for classifying domains to malware families, the computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to:
identify a corpus of malicious domains;
identify one or more suspicious domains;
extract a timeframe corresponding to the one or more suspicious domains;
calculate a rank correlation coefficient between the one or more suspicious domains and a current seed domain of the corpus of malicious domains;
determine whether the rank correlation coefficient exceeds a rank threshold for the one or more suspicious domains to provide a similarity count indicating a number of suspicious domains of the one or more suspicious domains whose rank correlation coefficients exceed the rank threshold;
compare the similarity count to a relation threshold; and
responsive to determining the similarity count exceeds the relation threshold, apply a tag to the one or more suspicious domains indicating that the one or more suspicious domains correspond to a same malware family as the current seed domain.