Patent ID: 8566928
Filing Date: 2013-10-22
Classification: G06F,H04L

Abstract:
1. A method of detecting a collection of compromised networks and/or computers, comprising: performing processing associated with collecting Domain Name System (DNS) data, utilizing a detection system in communication with a database, the DNS data generated by a DNS server and/or similar device, wherein the DNS data comprises DNS queries, wherein the collected DNS data comprises DNS query rate information, and wherein the collecting DNS data from the DNS server comprises: performing processing associated with recording an IP address and/or traffic information from a compromised computer when the compromised computer contacts another computer; performing processing associated with examining the collected DNS data relative to DNS data from known comprised and/or uncompromised computers; and performing processing associated with determining an existence of the collection of compromised networks and/or computers, and/or an identity of compromised networks and/or computers, based on the examination.