Patent Document ID: 9306971
Application ID: 14295758
Patent Flag: 1

Claim One:
1. A method, comprising: monitoring, by a network interface, a protected computer network that is to be protected from malicious software, and an infected computer network that is known to be infected with malicious software; extracting, by a processor, from both the protected computer network and the infected computer network, first communication transactions that are known to be malicious; extracting, by the processor, only from the protected computer network, second communication transactions that are not known to be malicious; identifying, by the processor, one or more malicious communication transactions exchanged with the protected computer network, by processing the first and second communication transactions; wherein identifying the malicious communication transactions comprises creating, by the processor, based on the extracted first and second communication transactions, one or more models that distinguish the malicious communication transactions from innocent communication transactions, and detecting the malicious communication transactions using the models; wherein identifying the malicious communication transactions comprises generating alerts, by the processor, based on the models, receiving an analysis of the alerts from an operator, and detecting, by the processor, the malicious communication transactions based on the analysis of the alerts by the operator; and wherein extracting the first communication transactions comprises selecting, by the processor, the first communication transactions depending on reputation levels of respective hosts participating in the communication transactions, and comprising updating, by the processor, at least one of the reputation levels based on the analysis of the alerts by the operator.