Patent Document ID: 9838407
Application ID: 15085551
Patent Flag: 1

Claim One:
1. A method comprising steps of: obtaining internal log data of a computer network of an enterprise; extracting values of a plurality of designated internal features from the log data; obtaining additional data from one or more external data sources; extracting values of a plurality of designated external features from the additional data; applying the extracted values to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains; identifying a subset of the domains based on their respective malicious activity risk scores; and taking one or more proactive security measures against the identified subset of domains; wherein the malicious activity risk scores indicate likelihoods that the respective domains are associated with malware; wherein the designated internal features comprise one or more communication related features, one or more domain structure related features, one or more uniform resource locator (URL) related features, and one or more user agent (UA) related features; wherein the designated external features comprise one or more registration related features, one or more autonomous system related features, and one or more country related features; and wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.