Patent ID: 8938803
Filing Date: 2015-01-20
Classification: H04L

Abstract:
1. A computer-implemented method for detecting undesirable domains, the method comprising executing instructions on one or more computers for: generating a log of domain name service (DNS) lookup operations performed by a plurality of instances executing in a programmable execution service (PES); comparing domains identified in the log to a list of known undesirable domains to identify one or more of the instances executing in the PES as compromised instances; and identifying one or more new undesirable domains by comparing DNS lookup operations performed by the compromised instances with DNS lookup operations performed by the plurality of instances executing in the PES, wherein the one or more new undesirable domains are identified to be one or more of the domains for which DNS lookup operations were performed by the compromised instances a significantly greater number of times than by the plurality of instances executing in the PES.