Patent ID: 7543055

Claim:
A method for identifying a network threat, comprising: assembling a set of names of files responsible for proliferating a network threat and a set of names of files previously identified as not responsible for proliferating a network threat; inserting a network traffic monitor within a network service provider's infrastructure, the network traffic monitor configured to identify a first domain responsible for presently communicating at least one file from the set of names of files responsible for proliferating a network threat; searching the first domain for files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; analyzing the content of the files not associated with either of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat; and adding a file name to one of the set of names of files responsible for proliferating a network threat and the set of names of files previously identified as not responsible for proliferating a network threat responsive to the step of analyzing.