Patent ID: 8554907

Claim:
A method of predicting the reputation of a single computer network resource, said method comprising: for said computer network resource having an unknown reputation, receiving count values of computer network traffic originating periodically from said single computer network resource; identifying a plurality of unique symbolic identifiers, each symbolic identifier representing a unique numerical range of possible count values; assigning to each of said count values one of said symbolic identifiers, said each count value falling within the unique numerical range of said assigned symbolic identifier; forming a chronological sequence of said assigned symbolic identifiers for said computer network resource of unknown reputation, said chronological sequence ordered based upon when said computer network traffic originates; receiving a fixed sequence of a subset of said symbolic identifiers that represents computer network traffic of a known network resource identified as being malicious; determining that said fixed sequence matches with a substring of said chronological sequence; and when it is determined said fixed sequence matches, outputting an indication of said match.