Patent ID: 8627473
Filing Date: 2014-01-07
Classification: H04L

Abstract:
1. A method for analyzing backbone traffic to determine a plurality of compromised hosts from among a plurality of hosts on a network, the backbone traffic including a plurality of data flows, the method comprising: analyzing, with a processor, each of the plurality of data flows included in the backbone traffic to determine a plurality of peer-to-peer data flows, each of the plurality of peer-to-peer data flows being one of the plurality of data flows and having a source address and a destination address that are each unassociated with a domain name wherein each of the plurality of data flows is analyzed to determine the plurality of peer-to-peer data flows by searching a database of domain name system records to determine whether the source address and the destination address of each of the plurality of data flows are each unassociated with any domain name; and analyzing, with the processor, the plurality of peer-to-peer data flows to determine the plurality of compromised hosts from among the plurality of hosts, each of the plurality of compromised hosts being interconnected with another of the plurality of compromised hosts via at least one of the plurality of peer-to-peer data flows.