Patent Document ID: 8260914
Application ID: 12821098

Base Claim:
1. A method for detecting automatically generated malicious domain names in a network, comprising: identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute; analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries; analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set domain names; and generating an alert of domain fluxing based on the distribution metric according to a pre-determined criterion.

---

Claim 2:
2. The method of claim 1 , further comprising: identifying, in the network and in response to generating the alert, a source node of the plurality of DNS queries; and facilitating in performing a network security operation with respect to the source node, wherein the automatically generated malicious domain names are used for at least one selected from a group consisting of controlling a botnet and conducting a spam email campaign.