Patent Document ID: 9300684
Application ID: 13491425
Patent Flag: 1

Claim One:
1. A computer-implemented method for detecting aberrant behavior in time-series data, comprising: obtaining, via one or more processors, from a database associated with a Domain Name System (DNS) server, first time-series observation data; storing, via the one or more processors, in a round robin database and as an entry in a first layer of the round robin database, a first value corresponding to a number of queries that occurred during a first time interval of a first length, wherein each entry in the first layer of the round robin database corresponds to a time interval of the first length; storing, via the one or more processors, in the round robin database and as an entry in the first layer of the round robin database, a second value corresponding to a number of queries that occurred during a second time interval of the first length; storing, via the one or more processors, in the round robin database and as an entry in a second layer of the round robin database, a third value corresponding to a number of queries that occurred during a third time interval of a second length larger than the first length, wherein: each entry in the second layer of the round robin database corresponds to a time interval of the second length; the third value comprises an aggregation of the first value and the second value; and the third time interval comprises the first time interval and the second time interval; determining, via the one or more processors and using entries in the second layer of the round robin database, time-series prediction data representative of a predicted trend of the first time-series observation data; determining, via the one or more processors, a standard deviation value representative of a deviation between the first time-series observation data and the time-series prediction data; determining, via the one or more processors, a threshold based, at least in part, on the standard deviation value; and detecting, via the one or more processors, aberrant behavior corresponding to malicious software in second time-series observation data by: determining second time-series prediction data representative of a predicted trend of the second time-series observation data; determining second time-series deviation data between the second time-series observation data and the second time-series prediction data; and comparing one or more values of the second time-series deviation data with a threshold; replacing the threshold with an updated threshold based, at least in part, on the second time-series observation data; and providing, via one or more input/output (I/O) devices, an indication that botnet activity exists based on detecting the aberrant behavior corresponding to malicious software.