Patent ID: 11876808
Assignee: ARBOR NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 7:
8. A computer system for managing threats to a protected network, comprising:
a memory configured to store instructions;
one or more processors disposed in communication with said memory, wherein the one or more processors upon execution of the instructions are configured to:
monitor network traffic from a plurality of internal production systems of the protected network for domain names;
determine, for each internal production system of the plurality of internal production systems over the course of a long time interval, a first collection of domain names that are output by the internal production system;
determine, for each internal production system of the plurality of internal production systems over the course of a short time interval, a second collection of domain names that are output by the internal production system, the short time interval subsequent to the long time interval;
compare, for each internal production system of the plurality of internal production systems, the domain names in the first collection with the domain names in the second collection;
identify one or more internal production systems of the plurality of internal production systems for which one or more domain names are included in the domain names in the second collection and are absent from the domain names in the first collection;
determine that one or more domain names are suspicious domain names when it is determined that a number of the one or more internal production systems satisfies a threshold number of internal production systems; and
request to treat the one or more domain names as suspicious.