Patent ID: 9027128
Filing Date: 2015-05-05
Classification: H04L

Abstract:
1. A computer-implemented process comprising: receiving a plurality of candidate uniform resource locators (URLs) in a computer; identifying malicious URLs in the computer by finding candidate URLs in the plurality of candidate URLs having a string that matches a malicious budget code in a listing of malicious budget codes, wherein malicious budget codes in the listing of malicious budget codes identify one or more spammers; parsing the identified malicious URLs to identify compromised domain names; collecting network traffic going to the identified compromised domain names; extracting candidate budget codes from the collected network traffic; deeming a candidate budget code among the candidate budget codes to be another malicious budget code that is not yet included in the listing of malicious budget codes when the candidate budget code appears in two or more distinct URLs with different domain names in the collected network traffic, wherein the candidate budget code is a substring of the two or more distinct URLs with different domain names; and adding the candidate budget code as another malicious budget code to the listing of malicious budget codes.