Patent Document ID: 9853991
Application ID: 15130829
Patent Flag: 1

Claim One:
1. A computer-implemented method to be performed by one or more processors of a computing system, the method comprising: determining a communication link profile for each of a plurality of internal computers that are within a network and have collectively communicated with a plurality of external computers that are outside of the network, the communication link profile for each internal computer comprising a representation of a set of external computers that have communicated with the internal computer; grouping the internal computers into computer clusters based on similarities in communication link profiles for each internal computer, wherein internal computers having communication link profiles that reach a threshold level of similarity are grouped into a same cluster; accessing a computer memory storing a list of previously identified command and control center computers; determining that a particular external computer of the plurality of external computers is identified as a command and control center computer by the list of previously identified command and control center computers; identifying a particular internal computer that has previously communicated with the particular external computer; identifying a particular computer cluster that includes the particular internal computer; determining a set of external computers that have communicated with one or more internal computers in the particular computer cluster; and designating each of the computers in the set of external computers that have communicated with one or more internal computers in the particular computer cluster as being a possible command and control center computer for further investigation.