Patent Document ID: 8516585
Application ID: 12897494

Base Claim:
1. A computer-implemented method for detecting malicious software agents, the method comprising: (a) constructing an association based on a plurality of failed queries for domain names sent to one or more domain-name servers by a plurality of hosts during a time period; (b) deriving, from the association, one or more candidate clusters of hosts; (c) determining, for each candidate cluster and for each of a plurality of time intervals during the time period, a number of new domain names appearing in the failed queries of the candidate cluster during the time interval; (d) determining, for each candidate cluster, a freshness metric based on the numbers of new domain names for the plurality of time intervals in the time period; and (e) detecting one or more malicious software agents on the hosts based on the one or more freshness metrics.

---

Claim 20:
20. The method of claim 1 , wherein step (d) comprises: (d1) comparing, for each of one or more time intervals, domain names queried during said each time interval with domain names queried prior to that time interval; and (d2) identifying, as new domain names, one or more domain names queried during the time interval but not prior to the time interval.