Patent Document ID: 9635049
Application ID: 14674905
Patent Flag: 1

Claim One:
1. A method comprising steps of: obtaining data relating to communications initiated by host devices of a computer network of an enterprise; processing the data to identify external domains contacted by the host devices in conjunction with the communications; applying a graph inference algorithm to analyze contacts of the host devices with the external domains in order to characterize one or more of the external domains as suspicious domains; and configuring one or more of the host devices to counteract malware infection from the suspicious domains; wherein the graph inference algorithm comprises a belief propagation algorithm; wherein the belief propagation algorithm models the contacts of the host devices with the external domains using a bipartite graph structure comprising: host device vertices corresponding to respective ones of the host devices; external domain vertices corresponding to respective ones of the external domains; and edges connecting particular ones of the host device vertices with particular ones of the external domain vertices; wherein applying the graph inference algorithm comprises generating a score for each of at least a subset of the external domains in a given one of a plurality of iterations of the belief propagation algorithm; wherein the scores are utilized to characterize the one or more external domains as suspicious domains in the given iteration; and wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.