Patent ID: 9635039
Date: 2017-04-25
CPC Classifications: H04L

Claim:
1. A computer implemented method for detecting callbacks from malicious code in a network communication based on operations conducted by one or more processors, comprising: performing a first analysis of a first portion of information within a network communication to determine one or more high quality indicators, each of the one or more high quality indicators includes a value that signifies a strong correlation of the network communication with callbacks; performing a second analysis of a second portion of information within the network communication to determine one or more supplemental indicators that are different from the one or more high quality indicators, each of the one or more supplemental indicators being associated with a protocol anomaly and includes a value that signifies a lower correlation of the network communication with callbacks than the one or more high quality indicators; storing the values assigned to the one or more high quality indicators and the one or more supplemental indicators in a memory, the memory communicatively coupled to the one or more processors; and classifying the network communication as to whether the network communication constitutes a callback by (i) classifying the network communication as a callback from malicious code when the one or more high quality indicators constitutes a value exceeding a predetermined threshold without consideration of the values associated with the one or more supplemental indicators, and in response to the value of the one or more high quality indicators failing to exceed the predetermined threshold, (ii) using the values associated with the one or more supplemental indicators in conjunction with the one or more high quality indicators to classify the network communication, wherein the first portion of the information includes at least one of a Uniform Resource Locator (URL), an Internet Protocol (IP) address, or a domain.