Patent Document ID: 9692771
Application ID: 13765606

Base Claim:
1. A method of protecting a computing apparatus by determining whether an Internet domain name is associated with a malicious Internet domain, the method comprising: obtaining, by a computing apparatus over a network, the Internet domain name from a user device, the Internet domain name including a plurality of characters; determining a first and second N-gram size; extracting a first plurality of N-grams of the first N-gram size from the Internet domain name and extracting a second plurality of N-grams of the second N-gram size from the Internet domain name; analyzing the first plurality of N-grams with respect to a first model, the first model being selected from a plurality of models based on the determined first N-gram size and associated with known typical Internet domain names, wherein analyzing the first plurality of N-grams with respect to the first model includes generating a first strangeness score that is dependent on respective locations of the first plurality of N-grams within the Internet domain name; analyzing the second plurality of N-grams with respect to a second model, the second model being selected from the plurality of models based on the determined second N-gram size and associated with known typical Internet domain names, wherein analyzing the second plurality of N-grams with respect to the second model includes generating a second strangeness score that is dependent on respective locations of the second plurality of N-grams within the Internet domain name; comparing the first strangeness score and the second strangeness score with a threshold; determining whether the Internet domain name is typical based on the comparing, wherein the Internet domain name is typical when the first strangeness score and the second strangeness score are below the threshold; and in response to determining that the Internet domain name is not typical, determining that the Internet domain name is not safe, and performing, by the computing apparatus, a security action to protect the computing apparatus with respect to the unsafe Internet domain name.

---

Claim 2:
2. The method of claim 1 , wherein the first score is generated by comparing the first plurality of N-grams to the set of N-grams.