Patent ID: 8612579

Claim:
One or more machine-readable storage media comprising a plurality of instructions that, in response to being executed, cause a computing device to: compare a destination address that identifies a remote computer to a list of known safe destination addresses stored on a computing device; determine a first time length of a first observation window and a second time length of a second observation window, wherein each of the first and second observation windows includes a plurality of tracking windows of a third time length; and update a persistence value associated with the destination address if the destination address does not match an entry in the list of known safe destinations, wherein the persistence value is dependent on (i) a first ratio of the number of tracking windows of the first observation window during which the computing device connected to the destination address at least once over the total number of tracking windows in the first observation window and (ii) a second ratio of the number of tracking windows of the second observation window during which the computing device connected to the destination address at least once over the total number of tracking windows in the second observation window.