Patent ID: 9245121
Filing Date: 2016-01-26
CPC Classification: H04L

Claim Text:
1. A method for detecting a malicious node in a network, comprising: obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name; generating, by a computer processor device and using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm; determining, by the computer processor and using a pre-determined formula, a score representing statistical characteristics of the cluster, wherein statistical characteristics include a cohesive measure, a size measure, and a repetitiveness measure, the cohesive measure representing similarity among the portion of the plurality of eSLD names included in the cluster, the size measure representing a tally of the eSLD names included in the cluster, and the repetitiveness measure representing a number of similar subsets of the cluster repetitively occurring at different time epochs; and assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.