METHOD AND SYSTEM FOR DETECTING MALICIOUS DOMAIN NAMES AT AN UPPER DNS HIERARCHY

• US 20140157414A1
• Filed: 12/04/2013
• Published: 06/05/2014
• Est. Priority Date: 02/01/2011
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Damballa Incorporated
• Inventors: ANTONAKAKIS, Manos, PERDISCI, Roberto, LEE, Wenke, VASILOGLOU, Nikolaos II
• Granted Patent: US 9,686,291 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method and system for detecting a malicious domain name, comprising: collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.

Claims

1. A method for detecting a malicious domain name, comprising:

performing processing associated with collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and

performing processing associated with utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.