Patent ID: 11930020
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 15:
16. One or more non-transitory computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform actions comprising:
accessing network traffic (NT) data that encodes at least one domain name resolution (DNR) transaction associated with a plurality of addresses that includes a plurality of domain name system (DNS) addresses and at least one target address;
employing the NT data to generate a graph data structure including a plurality of nodes representing the plurality of addresses and a plurality of edges, the plurality of nodes including a plurality of DNS nodes representing the plurality of DNS addresses and at least one target node representing the at least one target address, and the plurality of edges connecting each of the plurality of DNS nodes to at least one of the at least one target node based on the at least one DNR transaction;
accessing historical NT data that encodes at least one historical DNR transaction associated with a plurality of historical addresses that includes a plurality of historical DNS addresses and at least one historical target address, each historical DNR transaction of the at least one historical DNR transaction occurred prior to each DNR transaction of the at least one DNR transaction;
employing the historical NT data to generate a historical graph data structure including a plurality of historical nodes representing the plurality of historical addresses and a plurality of historical edges, the plurality of historical nodes including a plurality of historical DNS nodes representing the plurality of historical DNS addresses and at least one historical target node representing the at least one historical target address, and the plurality of historical edges connecting each of the plurality of historical DNS nodes to at least one of the at least one historical target node based on the at least one historical DNR transaction;
based on a comparison between the graph data structure and the historical graph data structure, assigning the node risk score to each node of the plurality of nodes;
based on the node risk score assigned to each of the plurality of nodes, identifying a first portion of the plurality of nodes;
classifying each address of the plurality of addresses that is represented by a node included in the identified first portion of the plurality of nodes as a suspicious address;
providing an indication of at least one address of the plurality of addresses that has been classified as a suspicious address.