Patent ID: 8667581

Claim:
A computer-implemented method for detecting malware propagation in a resource location store by a detection system, the resource location store being a data structure that contains, for each of a plurality of names, an entry that maps that name to an address associated with that name, the method comprising: generating, by a parent application which utilizes the resource location store, a request for a false entry from the detection system for insertion into the resource location store to detect malware propagation; sending to the detection system the generated request; receiving from the detection system the false entry, the false entry mapping a false name to an address associated with the detection system; and inserting the received false entry into the resource location store to detect malware propagation wherein the detection system receives a malware request sent by malware to the address of the false entry; and after receiving the malware request, sends a valid response to the malware request; the valid response sent to prevent the malware from considering the address of the false entry to be a trap door; determines whether the malware request sent to the address of the false entry is a misuse of the false entry according to a predetermined policy of misuse; and after determining that the malware request is a misuse of the false entry, requires human interaction before further use of the resource location store containing the misused false entry is allowed.