Patent ID: 8925087

Claim:
A system for detecting undesirable network outbreaks, the system comprising a plurality of domain name servers, each domain name server in the plurality of domain name servers comprising: a data storage system configured to store computer-readable code and data; a network interface communicatively connected to a network and configured to receive and send data via the network; a processor configured to access the data storage system and to execute said computer-readable code; and computer-readable code stored in the data storage system and configured to be executed by the processor so as to: receive a plurality of domain name system queries via the network interface, said plurality of domain name system queries including locality-sensitive hash codes embedded therein, wherein the locality-sensitive hash codes are generated from a message in hypertext markup language format by removing plain text and leaving hypertext markup language tags before applying a hashing algorithm; detect, from said plurality of domain name system queries, a group of the locality-sensitive hash codes which are similar to each other in that the group of the locality-sensitive hash codes has a number of bits in common that is greater than a threshold number of bits; identify said group of locality-sensitive hash codes as corresponding to a cluster based on a distribution of internet protocol addresses of sources of said plurality of domain name system queries; determine a signature and associated bitmask for said group of the locality-sensitive hash codes identified as corresponding to the cluster; add the signature and associated bitmask for the cluster to an undesirable identifier data structure; and forward the signature and associated bitmask to other domain name servers of the plurality of domain name servers via the network.