Patent ID: 9648037
Date: 2017-05-09
CPC Classifications: A61G,G06F,G06T,H04L

Claim:
1. A method, comprising: extracting a set of accessed domain names from a set of events stored in a field-searchable data store; receiving a communication corresponding to an indication as to when each accessed domain name in the set was registered with a registrar; identifying a respective registration time for each accessed domain name in the set of accessed domain names based on the communication, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; determining, for each accessed domain name in the set of accessed domain names, an access count corresponding to how many times the set of events indicates that the accessed domain name in the set of accessed domain names was accessed; identifying a subset of accessed domain names in the set of accessed domain names that have usage patterns that are not expected based on normal usage patterns using the identified respective registration time of each accessed domain name in the subset and an associated access count; causing display of information relating to each accessed domain name in the subset indicating that the accessed domain name is a potential security threat; wherein the method is performed by one or more computing devices.