Patent ID: 8578497
Filing Date: 2013-11-05
Classification: G06F,G06N,H04L

Abstract:
1. A method of analysis, comprising: performing processing associated with collecting, using at least one processor circuit in communication with at least one database, at least one pre-defined number of NX domain names from at least one asset in at least one real network, the NX domain names being domain names that are not registered; performing processing associated with utilizing, using the at least one processor circuit in communication with the at least one database, the statistical information about the at least one set of NX domain names to create testing vectors; performing processing associated with classifying, using at least one processor circuit in communication with at least one database, the testing vectors as benign vectors or malicious vectors by comparing the statistical information in the testing vectors to statistical information in training vectors using at least one meta-classifier comprising at least two classifiers; and performing processing associated with classifying, using at least one processor circuit in communication with at least one database, the at least one asset in the at least one real network as infected if the NX testing vector created from the real network NX domain names is classified as a malicious vector; wherein the training vectors and the testing vectors are created by: computing the statistical information for at least one set of NX domain names; and collecting the statistical information for each set of NX domain names in at least one vector.