Patent Document ID: 9948671
Application ID: 14317785
Patent Status: 1

Claim One:
1. A computerized method for detecting at least one malicious Hypertext Transfer Protocol (HTTP) request based on behavioral clustering of malware samples, comprising: collecting information about at least one HTTP request from malware samples in a controlled computer environment for a predetermined time; clustering, the malware samples into at least one cluster based on structural similarities among a plurality of the HTTP requests, the structural similarities comprising similarities between: a request method, Uniform Resource Locator (URL) path, URL page name, a parameter name, and a parameter value; applying a single-linkage hierarchical clustering algorithm and a Davies-Bouldin (DB) cluster validity index to create a plurality of clusters; merging together two or more of the plurality of clusters into meta clusters based on at least one HTTP behavior of each of the two or more of the plurality of clusters; extracting network signatures from the information about the at least one HTTP request for each at least one cluster, the network signatures being indicative of malware infection; and detecting at least one malicious HTTP request based on at least one of the extracted network signatures.