Patent ID: 8869268

Claim:
A method for securing a computer, comprising: transmitting, by the computer, suspect command and control data to a control center, wherein the suspect command and control data includes a reference to a domain name server (DNS) service, and the control center is configured to analyze the suspect command and control data, and update a command and control infrastructure library, if the suspect command and control data is identified as hostile; detecting by the computer, a hostile program stored on the computer, wherein the hostile program is identified by detecting that the reference to the DNS service in the suspect command and control data matches information in the command and control infrastructure library, the detecting the reference to the DNS service in the suspect command and control data is performed prior to the suspect command and control data being submitted to a DNS server, the hostile program is configured to be controlled by a hostile command and control infrastructure, and the hostile command and control infrastructure is associated with a hostile computer; and disrupting by the computer, the hostile command and control infrastructure, wherein the disrupting comprises impairing communication with the hostile program.