US 8,631,489 B2Grant

Method and system for detecting malicious domain names at an upper DNS hierarchy

Issue Date:2014-01-14

•24 Claims

•6 Drawing Sheets

Abstract

A method and system for detecting a malicious domain name, comprising: collecting domain name statistical information from a non-recursive domain name system name server (RDNS NS); and utilizing the collected domain name statistical information to determine if a domain name is malicious or benign.

Metadata

Assignee

Damballa, Inc.

Inventors

Manos Antonakakis
Roberto Perdisci
Wenke Lee
Nikolaos Vasiloglou

Application Information

Application Number:US 13/358,303

Filing Date:2012-01-25

Priority Date:2011-02-01

Art Unit:2494

Classifications

IPC:

G06F11/00G06F15/173

Patent Drawings (6 sheets)

Description

Cross-Reference to Related Applications

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 61/438,492, filed Feb. 1, 2011, which is incorporated by reference in its entirety.

Brief Description of the Figures

[0002] FIGS. 1-3 illustrate details related to a system for detecting a malicious domain name, according to one embodiment.

[0003] FIG. 4 illustrates a method for detecting a malicious domain name, according to one embodiment.

[0004] FIG. 5 illustrates details of how domain name statistical information can be collected, according to one embodiment.

Brief Description of Embodiments of the Invention

[0005] FIGS. 1-3 illustrates details related to a system for detecting a malicious domain name, according to one embodiment. (It should be noted that when the terms “a”, “an”, “said”, etc. are used throughout this application, they should be interpreted as “at least one” “the at least one”, etc.) In particular, a system can be provided that analyzes domain name system (DNS) query patterns at the upper DNS hierarchy (e.g., an authoritative name server (AUTH NS) level, a top-level domain name server (TLD NS) level, a root name server (NS) level) for the purpose of detecting new malicious domain names. In this way, in one embodiment, DNS operators can (e.g., automatically, using data available at their DNS servers) detect and remediate malicious domain names within their name space, helping to enable a rapid response. FIG. 1 illustrates various levels within a DNS hierarchy. As one moves higher up in the DNS hierarchy, global visibility of domain name resolutions can be increased. Thus, if DNS traffic is monitored (e.g., with a sensor) at an AUTH NS, all DNS queries originating from all recursive domain name system (RDNS) resolvers that attempt to resolve a domain name for which the AUTH NS has authority or is a point of delegation can be monitored. Even in the case where the NS server is anycasted (e.g., where the NS server sends data to the nearest host(s), which will then send the message to its nearest host(s), etc.), it can be assumed that the same physical authority governs all the anycasted servers. Therefore the global data gather can still be possible by the same physical authority. Similarly, if DNS traffic is monitored (e.g., with a sensor) at a TLD NS, all DNS queries originating from all RDNS resolvers and all AUTH NSs that attempt to resolve a domain name for which the TLD NS has authority or is a point of delegation can be monitored. Thus, in one embodiment, less sensors can be utilized, which can lessen: operational costs, privacy concerns, or difficulties related to establishing and maintaining relationships between different network operators, or any combination thereof. It should be noted that as one moves up higher in the DNS hierarchy, DNS caching can become stronger, and thus only a smaller subset of queries to domain names may be visible. This can be because, at the TLD level, the effect of DNS caching from recursive DNS servers worldwide can be analogous to the Time To Live (TTL) value for each domain name (e.g., the TTL for google.com can be shorter than the TTL for .com).

[0006] FIG. 2 illustrates an example of a domain name tree and a domain name resolution process. Section (a) of FIG. 2 illustrates how a domain name system can be structured like a tree. A domain name can identify a node in the tree. For example, the domain name F.D.B.A. can identify the path from the root “.” to a node F in the tree. The set of resource information associated with a particular domain name can be composed of resource records (RRs). The domain name related to a given RR is called the owner of that RR. The depth of a node in the tree can be referred to as a domain level. For example, A can be a TLD, B.A. can be a second-level domain (2LD), D.B.A. can be a third-level domain (3LD), etc.

[0007] The information related to the domain name space can be stored in a distributed domain name database. The domain name database can be partitioned by “cuts” made between adjacent nodes. After all cuts are made, each group of connected nodes can represent a separate zone. Each zone can have at least one node, and thus a domain name for which it is authoritative. For each zone, a node which is closer to the root than any other node in the zone can be identified. The name of this node can be used to identify the zone. For example, assume there is a zone cut in the path between nodes B and A, as shown in section (a) of FIG. 2. In this case, the zone to which the domain F.D.B.A. belongs can be identified with the domain name B.A. (The last “.”, which represents the root, is often omitted, such as when “com” is used instead of “com.”.) The RRs of the nodes of a given zone can be served by one or more AUTH NSs. A given AUTH NS can support one or more zones. AUTH NSs that have complete knowledge about a zone (e.g., storing the RRs for all the nodes related to the zone in question in its zone files) can be referred to as having authority over that zone. AUTH NSs can also delegate the authority over part of a (sub-) zone to another AUTH NS.

[0008] DNS queries can be initiated by a stub-resolver (e.g., a WINDOWS application) on a user's machine, which can rely on a RDNS resolver for obtaining a set of RRs owned by a given domain name. The RDNS resolver can be responsible for directly contacting the AUTH NSs on behalf of the stub-resolver, obtaining the requested information, and forwarding it back to the stub-resolver. The RDNS resolver can also be responsible for caching the obtained information for a certain period of time (e.g., called time to live (TLL)), so that if the same or another stub-resolver queries again for the same information within the TTL time window, the RDNS resolver will not need to re-contact the AUTH NS. This can help improve efficiency, for example, by downloading a website faster.

[0009] Section (b) of FIG. 2 depicts a query resolution process. In 1, the stub resolver requests a resolution for www.example.com. Assuming the RDNS resolver has no cached information whatsoever, it can start the iterative process. In 2, the RDNS resolver can request from a root NS a referral for www.example.com. The root NS (in 3) can provide back the delegation for www.example.com to the .com TLD NS. Following the same iteration (4 and 5), the .com TLD NS can refer the RDNS resolver to the AUTH NS for the zone example.com. In 6 and 7, the RDNS resolver can receive the DNS resolution for the domain name www.example.com. In 8, the RDNS resolver can provide back to the stub resolver the DNS resolution for the domain name www.example.com, which is 192.0.32.10.

[0010] FIG. 3 illustrates a system 300 for detecting a malicious domain name, according to one embodiment. The system 300 described in FIG. 3 can divide monitored data streams into epochs {E_i} (where i=1, . . . , m). For example, an epoch can be one month, one week, several days, one day, one hour, or any other time period. (It should be noted that if root servers are used, in addition to or instead of AUTH NSs and/or TLD NSs, the epoch may need to be longer than if just AUTH NSs and/or TLD NSs are used.) At the end of each epoch, system 300 can summarize the DNS traffic related to a given domain name d by computing a number of statistical features, such as: the diversity of the IP addresses associated with the RDNS servers that queried domain name d, the relative volume of queries from the set of querying RDNS servers, or historic information related to the IP space pointed to by d, or any combination thereof. System 300 can comprise a detection application 305, AUTH NSs 335, TLD NS 345, or detection reports 330, or any combination thereof. The detection application 305 can comprise: feature computation module 320, learning module 315, statistical classifier module 310, or knowledge database 310, or any combination thereof.

[0011] System 300 can comprise a training mode and an operation mode. As discussed below in FIG. 4, in training mode, domain name statistical information can be collected from one or more TLD NSs and/or one or more AUTH NSs and the collected domain name statistical information can be utilized to determine if a domain name is malicious or benign (e.g., legitimate). In operation mode, an additional domain name can be determined to be malicious or benign depending on how close the additional domain name's statistical information is to a known malicious domain name's statistical information.

[0012] Referring back to FIG. 3, a knowledge database 310 can store information about known malicious and known benign domain names, and related resolved IPs, for which the monitored AUTH NSs and TLD NSs are authoritative or are a point of delegation. The knowledge database 310 can store summary information about query/response behavior of each domain name across m days. Each domain name in the knowledge database 310, and in turn each feature vector in a set of training vectors V_traincan be associated with a malicious or benign label. The learning module 315 can take as input the set of training vectors V_train={vⁱ_d} (where i=1, . . . , m), where V d is in the knowledge base KB.

[0013] In operation mode, the feature computation module 320 and/or the statistical classifier module 310 can be utilized. The feature computation module 320 can comprise a function F (d, E_i)=vⁱ_dthat can map the DNS traffic in the epoch E_irelated to d into a feature vector vⁱ_d. The statistical classifier module 310 can utilize the feature vector to classify: the diversity of the IP addresses associated with the RDNS servers that queried the domain name d, the relative volume of queries from the set of querying RDNS servers, or historic information related to the IP space pointed to by d, or any combination thereof.

[0014] FIG. 4 illustrates a method 400 for detecting a malicious domain name, according to one embodiment. In 405, domain name statistical information can be collected from one or more TLD NSs, or one or more AUTH NSs, or one or more root servers, or any combination thereof. It should be noted that in some embodiments, only TLD NS(s) and/or AUTH NS(s) can be used. In 410, the collected domain name statistical information can be utilized to determine if a domain name is malicious or benign. In 415, an additional domain name can be determined to be malicious or benign depending on how close the additional domain name's statistical information is to a malicious domain name's statistical information.

[0015] For example, a stream of DNS traffic can be monitored and, at the end of an epoch, each domain d′∉KB (e.g., all unknown domains) extracted from the query/response streams can be mapped into a feature vector vⁱ_d′. As discussed in more detail below, the feature vectors can be: a requester diversity vector, a requester profile vector, or a requester reputation vector, or any combination thereof. For example, assume the domain name d′ is “imddos.my03.com”. (This domain name (along with others) was detected and sinkholed in the middle of 2010 (http://www.damballa.com/IMDDOS/) as part of a botnet.) Based on the daily observations (in this case on the day May, 21, 2010), the following three statistical vectors (which are described in more detail below) can be computed:

Requester Diversity Vector: 227 82 23 557 659 28.652173913 62.0934842839 3855.60079051 8.03658536585 18.1526076227 329.517163505 2.90308370044 4.88354100521 23.8489727496

Requester Profile Vector: 81.2208888635 689.103419745 688.485666667 474863.523104 474012.513206 638.422939068 1095.02680602 1094.0451592 1095.02680602 1199083.7059

Requester Reputation Vector: 0.0 0.0 16.0 0.0 0.0 0.0 0.0 0.0 294.0

[0016] At this point, given a domain d′, the statistical classifier module 325 can gather the statistical information from any or all of these vectors (or any others), compare it to historical information in knowledge database 310, and assign a label l_{d′, j}and a confidence score c (l_{d′, j}), which can express whether the query/response patterns observed for d′ during epoch E_jresemble either malicious or benign behavior, and with what probability. In this example, the trained classifier can label the imddos.my03.com domain name as being malicious (i.e., black) with 0.8 confidence. The output of the classifier can be the following:

[i: ‘2010-05-21’, ii: ‘imddos.my03.com’, iii: ‘black’, iv: ‘black’, v: ‘unknown’, vi: 0.80000000000000004],

[0017] where (i) is the evaluation day, (ii) is the domain name to be evaluated against the trained classifiers (e.g., using the last five days of traffic), (iii) is the correct label for the domain name (or evaluation label—which can be mandatory for proper evaluation of the classification system) (e.g., black), (iv) is the output of the classification system (e.g., black—which can be what the classifier proposes as a classification label), (v) is the label we have for the domain name at the classification day (e.g., unknown label—at the classification date there can be a number of domain names for which we have no prior information; thus we need the classification system and its proposed prediction label for the domain names with unknown labels), and (vi) is the classification probability confidence threshold on the label (iv). An operator may alter the classification probability confidence threshold so he/she can tune the false positive and true positive designations accordingly. In the example, the threshold can be set to 0.5. Detection application 305 can gather a series of labels and confidence scores S (v^j_d′)={(l_{d′, j}, c(l_{d′, j})} (where j=t, . . . , (t+m)) for m consecutive epochs (where t refers to a given starting epoch E_i). Detection application 305 can then compute the average confidence score C_M=avg_j{c(l_{d′, j})} for the malicious labels assigned to d′ by S across the m epochs, and an alarm can be raised if C_Mis greater than a predefined threshold θ.

[0018] Utilizing the above method, DNS operators can monitor DNS traffic towards their AUTH NS(s) and TLD NS(s), and independently (e.g., without the need of data from other networks) detect malicious domain names within the DNS zones over which they have authority, and can thus quickly take action to “clean up” their zone files by removing the detected malicious domain names. It should be noted that removing a domain name from a zone file can effectively “convict” the domain name and prevent future successful resolution from anywhere on the Internet.

[0019] FIG. 5 illustrates details of how domain name statistical information can be collected (405 of FIG. 4), according to one embodiment. In 505, requester diversity information can be collected. In 510, requester profile information can be collected. In 515, reputation information can be collected.

[0020] For each DNS query q_jregarding a domain name d and the related DNS response r_j, the response can be translated into a tuple Q_j(d)=(T_j, R_j, d, IPs_j), where T_jcan identify the epoch in which the query/response was observed, R_jcan be the IP address of the machine that initiated the query q_j, d can be the queried domain, and IPs_jcan be the set of resolved IP addresses as reported in the response r_j. It should be noted that since DNS queries and responses from the upper hierarchy are being monitored, in some cases, the response may be delegated to a name server which may not be monitored by system 300. In the case where the response does not carry the resolved IP address, the IPs set can be derived by leveraging a passive DNS database or by directly querying the delegated name server.

[0021] Given a domain name d and a series of tuples Q_j(d) (where j=1, . . . , m), measured during a certain epoch E_t(i.e., T_j=E_t, ∀j=1, . . . , m), the system 300 can extract the following groups of statistical features.

[0022] Requester Diversity.

[0023] In one embodiment, the requester diversity information can help characterize whether the machines (e.g., RDNS servers) that query a given domain name are localized or are globally distributed. The requester diversity information can be helpful based on the fact that the distribution of machines on the Internet that query malicious domain names is on average different from the distribution of IP addresses that query legitimate domain names. For example, if an IP address with a certain border gateway protocol (BGP) prefix queries a malicious domain name, it is more likely that other IP addresses with the same BGP prefix will also look up the same malicious domain, compared to if the domain name was benign. For example, if one computer in a business' network is compromised, it is more likely that other computers in the business' network are also compromised. For example, given a domain d and a series of tuples {Q_j(d)} (where j=1, . . . , m), the series of requester IP addresses {R_j}(where j=1, . . . , m), can be mapped to: a BGP prefix, autonomous system (AS) numbers, and country codes (CCs) to which the IP addresses belong. Then, the distribution of occurrence frequencies of the obtained BGP prefixes (sometimes referred to as classless inter-domain routing (CIDR) prefixes), the AS numbers, and CCs can be computed. For each of these three distributions, the mean, standard deviation and variance can be computed. Also, the absolute number of distinct IP addresses (e.g., distinct values of {R_j} (where j=1, . . . , m), and the number of distinct BGP prefixes, AS numbers and CCs can be considered. Thus, in some embodiments, thirteen statistical features that summarize the diversity of the machines that query a particular domain names, as seen from an AUTH NS or TLD NS, can be obtained.

[0024] In the example of imddos.my03.com for the day of May 21, 2010, the requester diversity vector can be:

cidr_div: 227

as_div: 82

cc_div: 23

rdns_cnt: 557

overall_cnt: 659

cc_avg: 28.652173913

cc_std: 62.0934842839

cc_var: 3855.60079051

asn_avg: 8.03658536585

asn_std: 18.1526076227

asn_var: 329.517163505

cidr_avg: 2.90308370044

cidr_std: 4.88354100521

cidr_var: 23.8489727496°

[0025] In the above example, cidr_div can reflect the Classless Inter-Domain Routing (CIDR) diversity, which can be the number of different networks that the RDNS requests originated from during an epoch. The as_div can reflect the autonomous system (AS) diversity, which can be the number of autonomous systems that the RDNS requests originated from during the epoch. The cc_div can reflect the country code (CC) diversity, which can be the number of different country codes that the RDNS requests originated from during the epoch. The rdns_cnt can be the distinct IP addresses that resolved the particular domain name in the epoch. The overall_cnt can be the total number of IP addresses that resolved the particular domain name in the epoch. The cc_avg, cc_std, and cc_var can reflect the average, standard deviation, and variance of the frequency of unique IPs address per unique country codes that are observed in the epoch. The asn_avg, asn_std, and asn_var can reflect the average, standard deviation, and variance of the frequency of the unique IPs addresses per unique AS observed in the epoch. The cidr_avg, cidr_std, and cidr_var can reflect the average, standard deviation, and variance of the frequency of unique IPs per unique CIDRs observed in the epoch.

[0026] Requester Profile.

[0027] In one embodiment, the requester profile information can help determine the level of popularity of the querying RDNS servers that query a domain name. The requester profile information can be helpful based on the fact that malicious domains can tend to be queried from requesters with a large number of Internet service provider (ISP) networks because, for example, ISP networks can offer little or no protection against malicious software propagation. In addition, the population of machines in ISP networks can be very large, and therefore the probability that a machine in the ISP network will become infected by malware can be very high. On the other hand, legitimate domains are often queried from both ISP networks and smaller organization networks, such as enterprise networks, which are usually better protected against malware and therefore tend to query fewer malicious domain names.

[0028] In one embodiment, a higher weight can be assigned to RDNS servers that serve a large client population because a large network can have a large number of infected machines. While it may not be possible to precisely estimate the population behind an RDNS server, because of the DNS cache effect, the population can be measured as follows: The DNS query/response stream for a large AUTH NS that has authority over a set of domains D can be monitored. Given an epoch E_t, all query tuples {Q_j(d)}, ∀j, d, seen during E_tcan be considered. R can be the set of all distinct requester IP addresses in the query tuples. For each IP address R_k∈R, the number c_t,k, of different domain names in D queried by R_kduring E_tcan be counted. The weight associated to the requester's IP address Rk can be defined as

[0029]

w_{t, k} = \frac{c_{t, k}}{\max_{l - t}^{\langle R \rangle} C_{t, l}} .

[0030] Once the weights w_t,khave been defined, the requester profile features can be measured. {Q_i(d′)} (where i=1 . . . h) can be the set of query tuples related to d′ observed during an epoch E_t. In addition, R(d′) can be the set of all distinct requester IP addresses in {Q_i(d′)}. For each R_k∈R(d′), the count c_t,kcan be computed as previously described. Then, given the set C_t(d′)={c_t,k}_k, the average, the biased and unbiased standard deviations, and the biased and unbiased variances of the values in C_t(d′) can be computed. (It should be noted that the biased and unbiased estimators of the standard deviation and variance can have different values when the cardinality |C_t(d′)| is small.)

[0031] In the example of imddos.my03.com for the day of May 21, 2010, the un-weighted requester profile vector can be:

Cav: 638.422939068

Cstd: 1095.02680602

Cstdpop: 1094.0451592

Cstdsamp: 1095.02680602

Cvar: 1199083.7059

[0032] The Cav can be the average count of unique domain names that a particular RDNS server requested in an epoch. Similarly, the Cstd, Cstdpop, Cstdsamp, and Cvar can be the standard deviation, the population standard deviation, the sample standard deviation and variance (respectively) of the frequency of the unique domain names that were looked up by each RDNS server in an epoch. In one embodiment, the proposed size of the epoch can be at least a week and the frequency count of unique domain names can be done based (at most, in some embodiments) on a daily granularity. It should be noted, however, that many other epochs and frequencies of counts can be utilized.

[0033] Similarly, for each R_k∈R(d′), the count c_t,kcan be computed as previously described. Afterwards, each count can be multiplied by the weight w_t-n,kto obtain the set WC_t(d′)={c_t,k*w_t-n,k}_kof weighted counts. (Note that n is the number of epochs.) It should of also be noted that the weights w_t,jcan be computed based on historical data about the resolver's IP address collected n epochs (e.g., seven days) before the epoch E_t. Then, the average, the biased and unbiased standard deviation, and the biased and unbiased variance of the values in WC_t(d′) can be computed.

[0034] In the example of imddos.my03.com for the day of May 21, 2010, the weighted requester profile vector can be:

Weighted Cav: 81.2208888635

Weighted Cstd: 689.103419745

Weighted Cstdpop: 688.485666667

Weighted Cvar: 474863.523104

Weighted Cvarpop: 474012.513206

[0035] The weighted features can follow the same logic described above, with each feature being multiplied by the previous described weighting factor (WC_t(d)).

[0036] Requester Reputation.

[0037] For the requester reputation information, in one embodiment, a dynamic domain name reputation system can be used. A dynamic domain name reputation system can use historic information about domain name resolutions to classify new domain names, for which little information (if any) is known. For example, it can be determined whether, and to what extent, a certain domain name d is related to domain names and IP addresses that have been historically recognized as either malicious or benign domain names. If d points to an IP address space that is known to host malicious activities, it is more likely that d itself is also involved in malicious activities. Alternatively, if d points to a well known, professionally run legitimate network, it is less likely that d is actually involved in malicious activity. A low reputation score can be assigned to new domain names that appear to share some similarities with known malicious domain names. Conversely, a high reputation score can be assigned to those domain names that share some similarities with legitimate, professionally administered domain names.

[0038] For example, given a domain name d and the set of query tuples {Q_j(d)} (where j=1, . . . , h), which can be obtained during an epoch E_t, the overall set of resolved IP addresses IPs(d, t)=∪_hj=1IPs_jcan be considered (where IPs_jcan be an element of the tuple Q_j(d)). If BGP(d, t) and AS(d, t) are the set of distinct BGP prefixes and autonomous system (AS) numbers to which the IP addresses in IPs(d, t) belong, the following features can be computed:

- [0039] Malware Evidence. Malware evidence can help determine whether a piece of malware can be linked with a particular network address space. Malware evidence can include the average number of known malicious domain names that in a certain epoch of time have pointed to each of the IP addresses in IPs(d, t), each of the BGP prefixes in BGP(d, t), or each of the AS numbers in AS(d, t), or any combination thereof, that are on a malware list.
- [0040] SBL Evidence. Spamhouse Block List (SBL) evidence (e.g., see www.spamhaus.org/sbl) can help show if a particular address space has historically been linked with fraudulent activities (e.g., spamming, phishing). SBL evidence can also include the average number of known malicious domain names that in a certain epoch of time have pointed to each of the IP addresses in IPs(d, t), each of the BGP prefixes in BGP(d, t), or each of the AS numbers in AS(d, t), or any combination thereof, that are on a SBL list.
- [0041] Whitelist Evidence. The number of IP addresses in IPs(d, t), the BGP prefixes in BGP(d, t), and the AS numbers in AS(d, t) that include IP addresses pointed to by domain names in all or part of certain white lists (e.g., DNSWL, ALEXA) can be determined.

[0042] For the example of imddos.my03.com for the day of May 21, 2010, the requester reputation vector can be:

botipcAV: 0.0

botcidrcAV: 0.0

botascAV: 16.0

sblipcAV: 0.0

sblcidrcAV: 0.0

sblascAV: 0.0

whipcAV: 0.0

whcidrcAV: 0.0

whascAV: 294.0

[0043] The botipcAV can be the average number of botnet IPs historically linked with this IP based on public evidence (e.g., Zeustracker https://zeustracker.abuse.ch/). The botcidrcAV and the botascAV can be the average number of botnet IPs historically linked with the CIDR and the AS that the IP address from the domain name points to. This count can also be obtained based on public evidence (e.g., Zeustracker https://zeustracker.abuse.ch/).

[0044] The sblipcAV can be the average number of SBL listings historically linked with this IP based on public evidence. The sblcidrcAV and the sblascAV can be can be the average number of SBL listings historically linked with the CIDR and the AS that the IP address from the domain name points to.

[0045] The whipcAV can be the average number of DNSWL (www.dnswl.org) listings historically linked with this IP based on public evidence. The whcidrcAV and the whascAV can be the average number of DNSWL (www.dnswl.org) listings historically linked with the CIDR and the AS that the IP address from the domain name points to.

[0046] While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example, and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in the form and detail can be made therein without departing from the spirit and scope of the present invention. Thus, the invention should not be limited by any of the above-described exemplary embodiments.

[0047] In addition, it should be understood that the figures described above, which highlight the functionality and advantages of the present invention, are presented for example purposes only. The architecture of the present invention is sufficiently flexible and configurable, such that it may be utilized in ways other than that shown in the figures.

[0048] Further, the purpose of the Abstract of the Disclosure is to enable the U.S. Patent and Trademark Office and the public generally, and especially the scientists, engineers and practitioners in the art who are not familiar with patent or legal terms or phraseology, to determine quickly from cursory inspection the nature and essence of the technical disclosure of the application. The Abstract of the Disclosure is not intended to be limiting as to the scope of the present invention in any way.

[0049] It should also be noted that the terms “a”, “an”, “the”, “said”, etc. signify “at least one”, “the at least one”, “said at least one”, etc., in the specification, claims and drawings. In addition, the term “comprising”, etc. signifies “including, but not limited to”, etc. in the specification, claims and drawings.

[0050] Finally, it is the applicant's intent that only claims that include the express language “means for” or “step for” be interpreted under 35 U.S.C. 112, paragraph 6. Claims that do not expressly include the phrase “means for” or “step for” are not to be interpreted under 35 U.S.C. 112, paragraph 6.

Claims

The invention claimed is:

1. A method for detecting a malicious domain name, comprising:

performing processing associated with collecting domain name statistical information from a non-recursive domain name system name server (non-RDNS NS), the domain name statistical information based on first order statistical features, the first order statistical features comprising: mean, standard deviation, variance of requesters for a domain name, domain name statistical information on diversity of IP addresses associated with a recursive device that queries a domain name d, a relative volume of queries from a set of a querying recursive device and historic information related to a IP space pointed to by the domain d; and

performing processing associated with utilizing the collected domain name statistical information to determine query patterns at an upper domain name system hierarchy to determine if a domain name is malicious or benign, the upper domain name system hierarchy comprising: an authoritative name server level, a top-level domain name server level, a root name server level, or any combination thereof.

2. The method of claim 1, wherein the domain name statistical information comprises requester diversity information, or requester profile information, or both.

3. The method of claim 2, wherein the domain name statistical information also comprises reputation information.

4. The method of claim 3, wherein the reputation information classifies a domain name as malignant or benign utilizing historic information about domain name resolution.

5. The method of claim 2, wherein the requester diversity information comprises diversity in terms of a network location of the recursive device that queries a domain name.

6. The method of claim 2, wherein the requester profile information comprises a level of popularity of the querying recursive device that queries a domain name.

7. The method of claim 1, further comprising:

performing processing associated with determining whether an additional domain name is malicious based on how close the additional domain name's statistical information is to the known malicious domain name's statistical information.

8. The method of claim 7, wherein the additional domain name is a new domain name.

9. The method of claim 1, wherein collecting domain name information from the non-RDNS NS comprises monitoring DNS traffic flowing towards the non-RDNS NS.

10. The method of claim 9, wherein monitoring DNS traffic flowing towards the non-RDNS NS allows monitoring of DNS queries from servers around the Internet that attempt to resolve a domain name for which the non-RDNS NS has authority or is a point of delegation.

11. The method of claim 1, wherein a sensor is attached to or by the non-RDNS NS.

12. The method of claim 1, wherein a DNS operator is able to detect and remediate a malicious domain name within his or her name space.

13. A system for detecting a malicious domain name, comprising:

a processing device configured for:

performing processing associated with collecting domain name statistical information from a non-recursive domain name system name server (non-RDNS NS) in communication with the processing device, the domain name statistical information based on first order statistical features, the first order statistical features comprising: mean, standard deviation, variance of requesters for a domain name, domain name statistical information on diversity of IP addresses associated with a recursive device that queries a domain name d, a relative volume of queries from a set of a querying recursive devices, and historic information related to a IP space pointed to by the domain d; and

14. The system of claim 13, wherein the domain name statistical information comprises requester diversity information, or requester profile information, or both.

15. The system of claim 14, wherein the domain name statistical information also comprises reputation information.

16. The system of claim 15, wherein the reputation information classifies a domain name as malignant or benign utilizing historic information about domain name resolution.

17. The system of claim 14, wherein the requester diversity information comprises diversity in terms of network location of the recursive device that queries a domain name.

18. The system of claim 14, wherein the requester profile information comprises a level of popularity of the querying recursive devices that queries a domain name.

19. The system of claim 13, further comprising:

20. The system of claim 19, wherein the additional domain name is a new domain name.

21. The system of claim 13, wherein collecting domain name information from the non-RDNS NS comprises monitoring DNS traffic flowing towards the non-RDNS NS.

22. The system of claim 21, wherein monitoring DNS traffic flowing towards the non-RDNS NS allows monitoring of DNS queries from servers around the Internet that attempt to resolve a domain name for which the non-RDNS NS has authority or is a point of delegation.

23. The system of claim 13, wherein a sensor is attached to or by the non-RDNS NS.

24. The system of claim 13, wherein a DNS operator is able to detect and remediate a malicious domain name within his or her name space.

Patent Citations (147)

Patent	Date	Inventor	Cited By
US4843540(A)	1989-06-01	Stolfo	Applicant
US4860201(A)	1989-08-01	Stolfo et al.	Applicant
US5363473(A)	1994-11-01	Stolfo et al.	Applicant
US5497486(A)	1996-03-01	Stolfo et al.	Applicant
US5563783(A)	1996-10-01	Stolfo et al.	Applicant
US5668897(A)	1997-09-01	Stolfo	Applicant
US5717915(A)	1998-02-01	Stolfo et al.	Applicant
US5748780(A)	1998-05-01	Stolfo	Applicant
US5920848(A)	1999-07-01	Schultzer et al.	Applicant
US6401118(B1)	2002-06-01	Thomas	Applicant
US6983320(B1)	2006-01-01	Thomas et al.	Applicant
US7013323(B1)	2006-03-01	Thomas et al.	Applicant
US7039721(B1)	2006-05-01	Wu et al.	Applicant
US7069249(B2)	2006-06-01	Stolfo et al.	Applicant
US7093292(B1)	2006-08-01	Pantuso	Applicant
US7136932(B1)	2006-11-01	Schneider	Examiner
US7152242(B2)	2006-12-01	Douglas	Applicant
US7162741(B2)	2007-01-01	Eskin et al.	Applicant
US7225343(B1)	2007-05-01	Honig et al.	Applicant
US7277961(B1)	2007-10-01	Smith et al.	Applicant
US7331060(B1)	2008-02-01	Ricciulli	Applicant
US7372809(B2)	2008-05-01	Chen et al.	Applicant
US7383577(B2)	2008-06-01	Hrastar et al.	Applicant
US7424619(B1)	2008-09-01	Fan et al.	Applicant
US7426576(B1)	2008-09-01	Banga et al.	Applicant
US7448084(B1)	2008-11-01	Apap et al.	Applicant
US7483947(B2)	2009-01-01	Starbuck	Applicant
US7487544(B2)	2009-02-01	Schultz et al.	Applicant
US7536360(B2)	2009-05-01	Stolfo et al.	Applicant
US7634808(B1)	2009-12-01	Szor	Applicant
US7639714(B2)	2009-12-01	Stolfo et al.	Applicant
US7657935(B2)	2010-02-01	Stolfo et al.	Applicant
US7665131(B2)	2010-02-01	Goodman	Applicant
US7698442(B1)	2010-04-01	Krishnamurthy	Applicant
US7752125(B1)	2010-07-01	Kothari et al.	Applicant
US7752665(B1)	2010-07-01	Robertson et al.	Applicant
US7779463(B2)	2010-08-01	Stolfo et al.	Applicant
US7784097(B1)	2010-08-01	Stolfo et al.	Applicant
US7818797(B1)	2010-10-01	Fan et al.	Applicant
US7913306(B2)	2011-03-01	Apap et al.	Applicant
US7930353(B2)	2011-04-01	Chickering	Applicant
US7962798(B2)	2011-06-01	Locasto et al.	Applicant
US7979907(B2)	2011-07-01	Schultz et al.	Applicant
US7996288(B1)	2011-08-01	Stolfo	Applicant
US8015414(B2)	2011-09-01	Mahone	Applicant
US8019764(B1)	2011-09-01	Nucci	Applicant
US8074115(B2)	2011-12-01	Stolfo et al.	Applicant
US8161130(B2)	2012-04-01	Stokes	Applicant
US8224994(B1)	2012-07-01	Schneider	Examiner
US8260914(B1)	2012-09-01	Ranjan	Applicant
US8341745(B1)	2012-12-01	Chau	Applicant
US8347394(B1)	2013-01-01	Lee	Examiner
US8516585(B2)	2013-08-01	Cao et al.	Applicant
US2001/0044785(A1)	2001-11-01	Stolfo et al.	Applicant
US2001/0052007(A1)	2001-12-01	Shigezumi	Applicant
US2001/0052016(A1)	2001-12-01	Skene et al.	Examiner
US2001/0055299(A1)	2001-12-01	Kelly	Examiner
US2002/0021703(A1)	2002-02-01	Tsuchiya et al.	Applicant
US2002/0066034(A1)	2002-05-01	Schlossberg et al.	Applicant
US2003/0065926(A1)	2003-04-01	Schultz et al.	Applicant
US2003/0065943(A1)	2003-04-01	Geis et al.	Applicant
US2003/0069992(A1)	2003-04-01	Ramig	Applicant
US2003/0167402(A1)	2003-09-01	Stolfo et al.	Applicant
US2003/0204621(A1)	2003-10-01	Poletto et al.	Applicant
US2004/0002903(A1)	2004-01-01	Stolfo et al.	Applicant
US2004/0111636(A1)	2004-06-01	Baffes et al.	Applicant
US2004/0187032(A1)	2004-09-01	Gels et al.	Applicant
US2004/0205474(A1)	2004-10-01	Eskin et al.	Applicant
US2004/0215972(A1)	2004-10-01	Sung et al.	Applicant
US2005/0021848(A1)	2005-01-01	Jorgenson	Applicant
US2005/0039019(A1)	2005-02-01	Delany	Examiner
US2005/0108407(A1)	2005-05-01	Johnson et al.	Applicant
US2005/0108415(A1)	2005-05-01	Turk et al.	Applicant
US2005/0257264(A1)	2005-11-01	Stolfo et al.	Applicant
US2005/0261943(A1)	2005-11-01	Quarterman et al.	Applicant
US2005/0265331(A1)	2005-12-01	Stolfo	Applicant
US2005/0281291(A1)	2005-12-01	Stolfo et al.	Applicant
US2006/0015630(A1)	2006-01-01	Stolfo et al.	Applicant
US2006/0075084(A1)	2006-04-01	Lyon	Applicant
US2006/0143711(A1)	2006-06-01	Huang et al.	Applicant
US2006/0146816(A1)	2006-07-01	Jain	Applicant
US2006/0156402(A1)	2006-07-01	Stone et al.	Applicant
US2006/0168024(A1)	2006-07-01	Mehr	Applicant
US2006/0178994(A1)	2006-08-01	Stolfo et al.	Applicant
US2006/0212925(A1)	2006-09-01	Shull	Applicant
US2006/0224677(A1)	2006-10-01	Ishikawa et al.	Applicant
US2006/0230039(A1)	2006-10-01	Shull	Applicant
US2006/0247982(A1)	2006-11-01	Stolfo et al.	Applicant
US2006/0253584(A1)	2006-11-01	Dixon	Applicant
US2007/0050708(A1)	2007-03-01	Gupta et al.	Applicant
US2007/0064617(A1)	2007-03-01	Reves	Applicant
US2007/0083931(A1)	2007-04-01	Spiegel	Applicant
US2007/0162587(A1)	2007-07-01	Lund et al.	Applicant
US2007/0239999(A1)	2007-10-01	Honig et al.	Applicant
US2007/0274312(A1)	2007-11-01	Salmela et al.	Applicant
US2007/0294419(A1)	2007-12-01	Ulevitch	Examiner
US2008/0028073(A1)	2008-01-01	Trabe et al.	Applicant
US2008/0028463(A1)	2008-01-01	Dagon	Applicant
US2008/0060054(A1)	2008-03-01	Srivastava	Applicant
US2008/0060071(A1)	2008-03-01	Hennan	Applicant
US2008/0098476(A1)	2008-04-01	Syversen	Applicant
US2008/0133300(A1)	2008-06-01	Jalinous	Applicant
US2008/0155694(A1)	2008-06-01	Kwon et al.	Applicant
US2008/0177736(A1)	2008-07-01	Spangler	Applicant
US2008/0184371(A1)	2008-07-01	Moskovitch	Applicant
US2008/0229415(A1)	2008-09-01	Kapoor	Applicant
US2008/0262985(A1)	2008-10-01	Cretu et al.	Applicant
US2008/0263659(A1)	2008-10-01	Alme	Applicant
US2008/0276111(A1)	2008-11-01	Jocoby et al.	Applicant
US2009/0055929(A1)	2009-02-01	Lee et al.	Applicant
US2009/0083855(A1)	2009-03-01	Apap et al.	Applicant
US2009/0106304(A1)	2009-04-01	Song	Applicant
US2009/0193293(A1)	2009-07-01	Stolfo et al.	Applicant
US2009/0210417(A1)	2009-08-01	Bennett	Applicant
US2009/0222922(A1)	2009-09-01	Sidiroglou et al.	Applicant
US2009/0241191(A1)	2009-09-01	Keromytis et al.	Applicant
US2009/0254658(A1)	2009-10-01	Kamikura et al.	Applicant
US2009/0254992(A1)	2009-10-01	Schultz et al.	Applicant
US2009/0282479(A1)	2009-11-01	Smith et al.	Applicant
US2009/0327487(A1)	2009-12-01	Olson et al.	Applicant
US2010/0011243(A1)	2010-01-01	Locasto et al.	Applicant
US2010/0023810(A1)	2010-01-01	Stolfo et al.	Applicant
US2010/0031358(A1)	2010-02-01	Elovici et al.	Applicant
US2010/0054278(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0064368(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0064369(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0077483(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0138919(A1)	2010-06-01	Peng	Applicant
US2010/0146615(A1)	2010-06-01	Locasto et al.	Applicant
US2010/0153785(A1)	2010-06-01	Keromytis et al.	Applicant
US2010/0169970(A1)	2010-07-01	Stolfo et al.	Applicant
US2010/0269175(A1)	2010-10-01	Stolfo et al.	Applicant
US2010/0274970(A1)	2010-10-01	Treuhaft et al.	Examiner
US2010/0275263(A1)	2010-10-01	Bennett et al.	Applicant
US2010/0281541(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0281542(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0332680(A1)	2010-12-01	Anderson et al.	Applicant
US2011/0041179(A1)	2011-02-01	Stahlberg	Applicant
US2011/0167493(A1)	2011-07-01	Song et al.	Applicant
US2011/0167494(A1)	2011-07-01	Bowen et al.	Applicant
US2011/0185428(A1)	2011-07-01	Sallam	Applicant
US2011/0214161(A1)	2011-09-01	Stolfo et al.	Applicant
US2012/0084860(A1)	2012-04-01	Cao et al.	Applicant
US2013/0232574(A1)	2013-09-01	Carothers	Applicant
WO2/37730	2002-05-01		Applicant
WO2/098100	2002-12-01		Applicant
WO2007/050244	2007-05-01		Applicant

Non-Patent Literature (353)

Cliff Changchun Zou et al., “Code Red Worm Propagation Modeling and Analysis”, In Proceedings of 9th ACM Conference on Computer and Communications Security (CCS '02), Nov. 18, 2002.Applicant
Cliff C. Zou et al,. “Email Worm Modeling and Defense”, In the 13th ACM International Confrerence on Computer Communications and Networks (CCCN '04), Oct. 27, 2004.Applicant
Cliff Changchun Zou et al., “Monitoring and Early Warning for Internet Worms”, In Proceedings fo the 10th ACM Conference on Computer and Communications Security (CCS '03), Oct. 2003.Applicant
Cliff Changchun Zou et al., “On the Performance of Internet Worm Scanning Strategies”, Technical Report TR-03-CSE-07, Umass ECE Dept., Nov. 2003.Applicant
Alexander Gostev, “Malware Elovution: Jan.-Mar. 2005”, Viruslist.com, http.//www.viruslist.com/en/analysis?pubid=162454316, (Apr. 18, 2005).Applicant
Jiang Wu et al., “An Effective Architecture and Algorithm for Detecting Worms with Various Scan Techniques”, In Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS '04), Feb. 2004.Applicant
Matthew M. Williamson et al., “Virus Throttling for Instant Messaging”, Virus Bulletin Conference, Sep. 2004, Chicago, IL, USA, (Sep. 2004).Applicant
F. Weimer, “Passive DNS Replication”, http://www.enyo.de/fw/software/dnslogger, 2005.Applicant
Ke Wang et al., “Anomalous Payload-Based Network Intrusion Detection”, In Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004), 2004.Applicant
P. Vixie et al,. “RFC 2136: Dynamic Updates in the Domain Name System (DNS Update)”, http://www.faqs.org/rfcs.rfc2136.html (Apr. 1997).Applicant
Joe Stewart, “Dipnet/Oddbob Worm Analysis”, SecureWorks, http://www/secureworks.com/research/threats/dipnet/ (Jan. 3, 2005).Applicant
Harold Thimbleby et al., “A Framework for Modeling Trojans and Computer Virus Infection”, Computer Journal, vol. 41, No. 7, pp. 444-458 (1999).Applicant
Paul Bachner et al., “Know Your Enemy: Tracking Botnets”, http://www.honeynet.org/papers/bots/, (Mar. 13, 2005).Applicant
“LockDown Security Bulletin—Sep. 23, 2001”, http://lockdowncorp.com/bots/ (Sep. 23, 2001).Applicant
Colleen Shannon et al., “The Spread of the Witty Worm”, http://www.caida.org/analysis/security/witty/index.xml (Mar. 19, 2004).Applicant
Moheeb Abu Rajab et al., “On the Effectiveness of Distributed Worm Monitoring”, In Proceedings fo the 14th USENIX Security Symposium (2005).Applicant
Niels Provos, “CITI Technical Report 03-1: A Virtual Honeypot Framework”, http://www.citi.umich.edu/techreports/reports/citi-tr-03-1.pdf. (Oct. 21, 2003).Applicant
“Know your Enemy: Honeynets”, http://www.honeypot.org/papers/honeynet, (May 31, 2006).Applicant
David Moore et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, In Proceedings of the IEEE INFOCOM 2003, Mar. 2003.Applicant
Joe Stewart, “I-Worm Baba Analysis”, http://secureworks.com/research/threats/baba (Oct. 22, 2004.Applicant
David Moore et al., “Slammer Worm Dissection: Inside the Slammer Worm”. IEEE Security & Privacy, vol. 1, No. 4 (Jul.-Aug. 2003).Applicant
David Moore et al., “Code-Red: A Case Study on the Spread and Victims of an Internet Worm”, http://www.icir.org/vern/imw-2002/imw2002-papers/209.ps/gz (2002).Applicant
Joe Stewart, “Sinit P2P Trojan Analysis”, http://www.secureworks.com/research/threats/sinit, (Dec. 8, 2003).Applicant
Martin Krzywinski, “Port Knocking—Network Authentication Across Closed Ports”, Sys Admin Magazine, vol. 12, pp. 12-17 (2003).Applicant
Christopher Kruegel et al., “Anomaly Detection of Web-Based Attacks”, In Proceedings of the 10th ACM Conference on Computer and Communication Security (CCS '03), Oct. 27-31, 2003, Washington, DC, USA, pp. 251-261.Applicant
“Dabber Worm Analysis”, LURHQ Threat Intelligence Group, http://www.lurhq.com/dabber.html (May 13, 2004).Applicant
Abstract of Jeffrey O. Kephart et al,. “Directed-Graph Epidemiological Models of Computer Viruses”, Proceedings on the 1991 IEEE Computer Society Symposium on Research in Security and Privacy; Oakland, CA, May 20-22, 1991; pp. 343-359 (May 20-22, 1991).Applicant
C. Kalt “RFC 2810—Internet Relay Chat: Architecture” http://faqs.org/rfcs/rfc2810.html (Apr. 2000).Applicant
Xuxian Jiang et al., “Cerias Tech Report 2005-24: Virtual Playgrounds for Worm Behavior Investigation”, Purdue University, Feb. 2005.Applicant
Neal Hindocha et al., “Malicious Threats and Vulnerabilities in Instant Messaging”, Virus Bulletin International Conference, Sep. 2003.Applicant
Thomer M. Gil, “NSTX (IP-over-DNS) HOWTO”, http://thomer.com/howtos/nstx.html, Nov. 4, 2005 (5 pages).Applicant
V. Fuller et al., “RFC 1519—Classless Inter-Domain Routing (CIDR): An Address Assignment and Aggregation Strategy”, http://www.faqs.org/rfcs/rfc1519.html(Sep. 1993).Applicant
David E. Smith “Dynamic DNS”, http://www.technopagan.org/dynamic (Aug. 7, 2006).Applicant
Dave Dittrich, “Active Response Continuum Research Project”, http://staff.washington.edu/dittrich/arc/ (Nov. 14, 2005).Applicant
Joe Stewart, “Akak Trojan Analysis”, http://www.secureworks.com/research/threats/akak/ (Aug. 31, 2004).Applicant
Monirul I. Sharif, “Mechanisms of Dynamic Analysis and DSTRACE”.Applicant
Kapil Kumar Singh, “IRC Reconnaissance (IRCRecon) Public IRC Heuristics (BotSniffer)” (Jul. 24, 2006).Applicant
http://www.trendmicro.com/en/home/us/home.htm.Applicant
“InterCloud Security Service”, http://ww.trendmicro.com/en/products/nss/icss/evaluate/overview.thm.Applicant
“2006 Press Releases: Trend Micro Takes Unprecedented Approach to Eliminating Botnet Threats with the Unveiling of InterCloud Security Service”, http://www.trendmicro.com/en/about/news/pr/archive/2006/pr092506.htm, (Sep. 25, 2006).Applicant
Paul F. Roberts, “Trend Micro Launches Anti-Botnet Service”, InfoWorld, http://www.infoworid.com/article/06/09/25/HNtrendintercloud—1.html (Sep. 25, 2006).Applicant
CNN Technology News—Expert: Botnets No. 1 Emerging Internet Threat, CNN.com, http://www.cnn.com/2006/TECH/internet/01/31/furst.index.html (Jan. 31, 2006).Applicant
Evan Cooke et al., “The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets”, In USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), Jun. 2005.Applicant
Sven Dietrich et al., “Analzying Distrubuted Denial of Service Tools: The Shaft Case”, Proceedings of the 14th Systems Administration Conference (LISA 2000), New Orleans, Louisiana, USA, Dec. 3-8, 2000.Applicant
Felix C. Freiling et al,. “Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks”, ESORICS 2005, LNCS 3679, pp. 319-335 (2005).Applicant
Luiz Henrique Gomes et al., “Characterizing a Spam Traffic”, In Proc. ACM SIGCOMM Internet Measurement Conference (IMC '04), Oct. 25-27, 2004 Taormina, Sicily, Italy, pp. 356-369.Applicant
Christopher W. Hanna, “Using Snort to Detect Rogue IRC Bot Programs”, Technical Report, SANS Institute 2004 (Oct. 8, 2004).Applicant
Jaeyeon Jung et al., “An Empirical Study of Spam Traffic and the Use of DNS Black Lists”, In Proc. ACM SIGCOMM Internet Measurement Conference (IMC '04), Oct. 25-27, 2004, Taormina, Sicily, Italy, pp. 370-375.Applicant
Srikanth Kandula et al., “Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds”, Technical Report LCS TR-969, Laboratory for Computer Science, MIT, 2004.Applicant
Sven Krasser et al., “Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization”, Proceedings of the 6th IEEE Information Assurance Workshop (Jun. 2005).Applicant
David Moore et al., “Inferring Internet Denial-of-Service Activity”, In Proceedings of the 2001 USENIX Security Symposium, 2001.Applicant
Stephane Racine, “Master's Thesis: Analysis for Internet Relay Chat Usage by DDoS Zombies”, ftp://www.tik.ee.ethz.ch/pub/students/2003-2004-Wi/MA-2004-01.pdf (Nov. 3, 2003).Applicant
Anirudh Ramachandran et al., “Understanding the Network-Level Behavior of Spammers”, SIGCOMM '06, Sep. 11-15, 2006, Pisa, Italy, pp. 291-302.Applicant
Ramneek Puri, “Bots & Botnet: An Overview”, SANS Institute 2003, http://www.giac.com/practical/GSEC/Ramneek—Puri—GSEC.pdf (Aug. 8, 2003).Applicant
Stuart E. Schechter et al., “Access for Sale:A New Class of Worm”, In 2003 ACM Workshop on Rapid Malcode (WORM '03), ACM SIGSAC, Oct. 27, 2003, Washington, DC, USA.Applicant
Stuart Staniford, “How to Own the Internet in Your Spare Time”, In Proc. 11th USENIX Security Symposium, San Francisco, CA, Aug. 2002.Applicant
Martin Overton, “Bots and Botnets: Risks, Issues and Prevention”, 2005 Virus Bulletin Conference at the Burlington, Dublin, Ireland, Oct. 5-7, 2005, http://arachnid.homeip.net/papers/VB2005-Bots—and—Botnets-1.0.2.pdf.Applicant
Yin Zhang et al., “Detecting Stepping Stones”, Proceedings of the 9th USENIX Security Symposium, Denver, Colorado, USA, Aug. 14-17, 2000.Applicant
Joe Stewart, “Bobax Trojan Analysis”, http://www.lurhq.com/bobax.html, May 17, 2004.Applicant
David Brumley et al., “Tracking Hackers on IRC”, http://www.doomded.com/texts/ircmirc/TrackingHackersonIRC.htm, Dec. 8, 1999.Applicant
Brian Krebs, “Bringing Botnets Out of the Shadows”, Washingtonpost.com, http://www.washingtonpost.com/wp-dyn/content/artcile/2006/03/21/AR2006032100279—pf.html, Mar. 21, 2006.Applicant
“SwatIT: Bots, Drones, Zombies, Worms and Other Things That Go Bump in the Night”, http://swatit.org/bots, 2004.Applicant
Christian Kreibich, “Honeycomb; Automated NIDS Signature Creation Using Honeypots”, 2003, http://www.cl.cam.ac.uk/research/srg/netos/papers/2003-honeycomb-sigcomm-poster.pdf.Applicant
DMOZ Open Directory Project, Dynamic DNS Providers List, http://dmoz.org/Computers/Software/Internet/Servers/Address—Management/Dynamic—DNS—Services/.Applicant
David Moore, “Network Telescopes: Observing Small or Distant Security Events”, http://www.caida.org/publications/presentations/2002/usenix—sec/usenix—sec—2002—files/frame.htm; Aug. 8, 2002.Applicant
Vincent H. Berk et al., “Using Sensor Networks and Data Fusion for Early Detection of Active Worms”, Sensors, and Command, Control, Communications, and Intelligence (C3il) Technologies for Homeland Defense and Law Enforcement II, Proceedings of SPIE, vol. 5071, pp. 92-104 (2003).Applicant
David Dagon et al., “Worm Population Control Through Periodic Response”, Technical Report, Georgia Institute for Technology, Jun. 2004.Applicant
Scott Jones et al., “The IPM Model of Computer Virus Management”, Computers & Security, vol. 9, pp. 411-418 (1990).Applicant
Jeffrey O. Kephart et al., “Directed-Graph Epidemiological Models of Computer Viruses”, In Proceedings of IEEE Symposium on Security and Privacy, pp. 343-359 (1991).Applicant
Darrell M. Kienzle et al., “Recent Worms: A Survey and Trends”, In WORM '03, Proceedings of the 2003 ACM Workshop on Rapid Malcode, Washington, DC, USA, pp. 1-10, Oct. 27, 2003.Applicant
Bill McCarty, “Botnets: Big and Bigger”, IEEE Security and Privacy Magazine, vol. 1, pp. 87-89 (2003).Applicant
Xinzhou Qin et al., “Worm Detection Using Local Networks”, Technical Report GIT-CC-04-04, College of Computing, Georgia Institute of Technology, Feb. 2004.Applicant
Yang Wang et al., “Modeling the Effects of Timing Parameters on Virus Propagation”, In Proceedings of ACM CCS Workshop on Rapid Malcode (WORM '03), Washington, DC, pp. 61-66, Oct. 27, 2003.Applicant
Donald J. Welch et al., “Strike Back: Offensive Actions in Information Warfare”, in AMC New Security Paradigm Workshop. pp. 47-52 (1999).Applicant
T. Liston, “Welcome to my Tarpit: The Tactical and Stragetic Use of LaBrea”, http://www.hackbusters.net/LaBrea/LaBrea.txt, Oct. 24, 2001.Applicant
R. Pointer, “Eggdrop Development”, http://www.eggheads.org, Oct. 1, 2005.Applicant
S. Staniford, “Code Red Analysis Pages: July Infestation Analysis”, http://silicondefense.org/cr/july.html, Nov. 18, 2001.Applicant
Alex Ma, “NetGeo—The Internet Geographic Database”, http://www.caida.org/tools/utilities/netgeo/index.xml, Sep. 6, 2006.Applicant
MathWorks Inc. Simulink, http://www.mathworks.com/products/simulink, Dec. 31, 2005.Applicant
David Dagon et al., “Modeling Botnet Propagation Using Time Zones”, In Proceedings of the 13th Annual Network and Distributed Systems Security Symposium (NDSS '06), Feb. 2006.Applicant
John Canavan, “Symantec Security Response: W32.Bobax.D”, http://www.sarc.com/avcent/venc/data/w32.bobax.d.html, May 26, 2004.Applicant
“Whois Privacy”, www.gnso.icann.org/issues/whois-privacy/index/shtml, Jun. 3, 2005.Applicant
John D. Hardin, “The Scanner Tarpit HOWTO”, http://www.impsec.org/linus/security/scanner-tarpit.html, Jul. 20, 2002.Applicant
Charles J. Krebs, “Ecological Methodology”, Harper & Row, Publishers, New York, pp. v-x, 15-37, 155-166, and 190-194 (1989).Applicant
D.J. Daley et al., “Epidemic Modeling: An Introduction”, Cambridge University Press, pp. vii-ix, 7-15, and 27-38 (1999).Applicant
Lance Spitzner, “Honeypots: Tracking Hackers”, Addison-Wesley, pp. vii-xiv, 73-139, 141-166, and 229-276 (2003).Applicant
International Search Report issued in Application No. PCT/US06/038611 mailed Jul. 8, 2008.Applicant
Written Opinion issued in Application No. PCT/US06/038611 mailed No. PCT/US06/038611 mailed Jul. 8, 2008.Applicant
International Preliminary Report on Patentability issued in Application No. PCT/US06/038611 mailed Mar. 26, 2009.Applicant
O. Diekmann et al,. “Mathematical Epidemiology of Infectious Diseases: Model Building, Analysis and Interpretation”, John Wiley & Son, Ltd., 2000, pp. v-xv and 1-303.Applicant
Jelena Mirkovic et al,. “Internet Denial of Service: Attack and Defense Mechanisms”, Prentice Hall Professional Technical Reference, 2004, pp. v-xxii and 1-372.Applicant
“Symantec Internet Security Threat Report: Trends for Jan. 1, 2004-Jun. 30, 2004” Symantec, Sep. 2004, pp. 1-54.Applicant
David Dagon et al., “HoneyStat: 2004, Local Worm Detection Using Honeypots”, RAID 2004, LNCS 3224, pp. 39-58 (2004).Applicant
Jonghyun Kim et al., “Measurement and Analysis of Worm Propagation on Internet Network Topology”, IEEE, pp. 495-500 (2004).Applicant
Andreas Marx, “Outbreak Response Times: Putting AV to the Test”, www.virusbtn.com, Feb. 2004, pp. 4-6.Applicant
Vinod Yegneswaran et al., “Global Intrusion Detection in the DOMINO Overlay System”, Proceedings of Network and Distributed Security Symposium (NDSS), 17 pages Feb. 2004.Applicant
Vinod Yegneswaran et al., “On the Design and Use of Internet Sinks for Network Abuse Monitoring”, RAID 2004, LNCS 3224, pp. 146-165 (2004).Applicant
Cliff Changchun Zou et al., “Worm Propagation Modeling and Analysis Under Dynamic Quarantine Defense”, WORM'03, Oct. 27, 2003, Washington, DC USA, 10 pages.Applicant
Cliff C. Zou et al., “Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information”, Technical Report: TR-03-CSE-06, Principles of Advanced and Distributed Simulation (PADS) 2005, pp. 199-206, Jun. 1-3, 2005.Applicant
Thorsten Holz, “Anti-Honeypot Technology”, 21st Chaos Communication Congress, slides 1-57, Dec. 2004.Applicant
“CipherTrust's Zombie Stats”, http://www.ciphertrust.com/resources/statistics/zombie.php 3 pages, printed Mar. 25, 2009.Applicant
Joe Thorsten, “Phatbot Trojan Analysis”http://www.secureworks.com/research/threats/phatbot, Mar. 15, 2004, 3 pages.Applicant
Thorsten Holz et al., “A Short Visit to the Bot Zoo”, IEEE Security & Privacy, pp. 7679 (2005).Applicant
Michael Glenn, “A Summary of DoS/DDoS Prevention, Monitoring and Mitigation Techniques in a Service Provider Environment”, SANS Institute 2003, Aug. 21, 2003, pp. ii-iv, and 1-30.Applicant
Dennis Fisher, “Thwarting the Zombies”, Mar. 31, 2003, 2 pages.Applicant
Dongeun Kim et al., “Request Rate Adaptive Dispatching Architecture for Scalable Internet Server”, Proceedings of the IEEE International Conference on Cluster Computing (CLUSTER'00); pp. 289-296 (2000).Applicant
Keisuke Ishibashi et al., “Detecting Mass-Mailing Worm Infected Hosts by Mining DNS Traffic Data”, SIGCOMM'05 Workshops, pp. 159-164 (Aug. 22-26, 2005).Applicant
Nicholas Weaver et al., “A Taxonomy of Computer Worms”, WORM'03, pp. 11-18 (Oct. 27, 2003).Applicant
Stephan Axelsson, “The Base-Rate Fallacy and the Difficulty of Intrusion Detection”, ACM Transactions on Information and System Security, vol. 3, No. 3, pp. 186-205 (Aug. 2000).Applicant
Niel Landwehr et al., “Logistic Model Trees”, Machine Learning, vol. 59, pp. 161-205 (2005).Applicant
Richard O. Duda et al., “Pattern Classification, Second Edition”, John Wiley & Sons, Inc., pp. vii-xx, and 1-654, Copyright 2001.Applicant
Guofei Gu et al. “BotMiner: Clustering Analysis of Network Traffic Protocol- and Structure-Independent Botnet Detection”, 2008, USENIX Security Symposium, pp. 139-154.Applicant
Zhu et al., “Using Failure Information Analysis to Detect Enterprise Zombies,” Lecture note of the Institute for Computer Science, Social-Informatics and Telecommunications Engineering, vol. 19, part 4, pp. 185-206, 2009.Applicant
Manos Antonakakis et al., “Building a Dynamic Reputation System for DNS”, 19th USENIX Security Symposium, Aug. 11-13, 2010 (17 pages).Applicant
Manos Antonakakis et al., “Detecting Malware Domains at the Upper DNS Hierarchy”, In Proceeding of the 20th USENIX Security Symposium, Aug. 8-12, 2011 (16 pages).Applicant
Leyla Bilge et al., “Exposure: Finding Malicious Domains Using Passive DNS Analysis”, 18th Annual Network and Distributed System Security Symposium, Feb. 6-9, 2011 (17 pages).Applicant
“Virus:Win32/Expiro.Z”. http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx, Jun. 9, 2001 (5pages).Applicant
Mike Geide, “Another Trojan Bamital Pattern”, http://research.zscaler.com/2011/05/another-trojan-bamital-pattern.html, May 6, 2011 (5 pages).Applicant
Sergey Golovanov et al., “TDL4—Top Bot”, http://www.secuirlist.com/en/analysis/204792180/TDL4—Top—Bot, Jun. 27, 2011 (15 pages).Applicant
P. Mockapetris, “Domain Names—Concepts and Facilities”, Network Working Group, http://www.ietf.org/rfc/rfc1034.txt, Nov. 1987 (52 pages).Applicant
P. Mockapetris, “Domain Names—Implementation and Specification”, Network Working Group, http://www,ietf.org/rfc/rfc1035.txt, Nov. 1987 (52 pages).Applicant
Phillip Porras et al. “SRI International Technical Report: An Analysis of Conficker's Logic and Rendezvous Points”, http://mtc.sri.com/Conficker/, Mar. 19, 2009, (31 pages).Applicant
Phillip Porras et al. “SRI International Technical Report: Conficker C Analysis”, http://mtc.sri.com/Conficker/addendumC, Apr. 4, 2009, (24 pages).Applicant
Paul Royal, Damballa, “Analysis of the Kracken Botnet”, Apr. 9, 2008 (13 pages).Applicant
Sergei Shevchenko, “Srizbi's Domain Calculator”, http://blog.threatexpert.com/2008/11/srizbix-domain-calculator.html, Nov. 28, 2008 (3 pages).Applicant
Sergei Shevchenko, “Domain Name Generator for Murofet”, http://blog.threatexpert.com/2010/10/domain-name-generator-for-murofet.html, Oct. 14, 2010 (4 pages).Applicant
P Akritidis et al., “Efficient Content-Based Detection of Zero-Day Worms”, 2005 IEEE International Conference in communications, vol. 2, pp. 837-843, May 2005.Applicant
M. Patrick Collins et al., “Hit-List Worm Detection and Bot Identification in Large Networks Using Protocol Graphs”, RAID 2007, LNCS 4637, pp. 276-295 (2007).Applicant
Nicholas Weaver et al., “Very Fast Containment of Scanning Worms”, In proceedings of the 13th USENIX Security Symposium, pp. 29-44, Aug. 9-13, 2004.Applicant
David Whyte et al., “DNS-Based Detection of Scanning Worms in an Enterprise Network”, In Proc. of the 12th Annual Network and Distributed System Security Symposium, pp. 181-195, Feb. 3-4, 2005.Applicant
Cristian Abad et al., “Log Correlation for Intrusion Detection: A Proof of Concept”, In Proceedings of the 19th Annual Computer Security Application Conference (ACSAC'03), (11 pages) (2003).Applicant
Lela A. Adamic et al., “Zipf's Law and the Internet”, Glottometrics, vol. 3, pp. 143-150 (2002).Applicant
K.G. Anagnostakis et al., “Detecting Targeted Attacks Using Shadow Honeypots”, In Proceedings of the 14th USENX Secuirty Symposium, pp. 129-144 (2005).Applicant
Paul Baecher et al., “The Nepenthes Platform: An Efficient Approach to Collect Malware”, In Proceedings of Recent Advances in Intrusion Detection (RAID 2006), LNCS 4219, pp. 165-184, Sep. 2006.Applicant
Paul Barford et al., “An Inside Look at Botnets”, Special Workshop on Malware Detection, Advances in Information Security, Spring Verlag, pp. 171-192 (2006).Applicant
James R. Binkley et al., “An Algorithm for Anomaly-Based Botnet Detection”, 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI '06), pp. 43-48, Jul. 7, 2006.Applicant
Steven Cheung et al., “Modeling Multistep Cyber Attacks for Scenario Recognition”, In Proceedings of the Third DARPA Information Survivability Conference and Exposition (DISCEX III), vol. 1, pp. 284-292, Apr. 22-24, 2003.Applicant
Evan Cooke et al., “The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets”, Steps to Reducing Unwanted Traffic on the lnternet Workshop (SRUTI '05), pp. 39-44, Jul. 7, 2005.Applicant
Frederic Cuppens et al., “Alert Correlation in a Cooperative Intrusion Detection Framework”, In Proceedings of IEEE Symposium on Security and Privacy 2002, pp. 202-215 (2002).Applicant
David Dagon et al., “Modeling Botnet Propagation using Time Zones”, The 13th Annual Network and Distributed System Security Symposium 2006, Feb. 2-3, 2006 (18 pages).Applicant
Roger Dingledine et al., “Tor: The Second-Generation Onion Router”, In Proceedings of the 13th Usenix Security Symposium, pp. 303-320 Aug. 9-13, 2004.Applicant
Steven T. Eckman et al., “STATL: An Attack Language for State-Based Intrusion Detection”, Journal of Computer Security, vol. 10, pp. 71-103 (2002).Applicant
Daniel R. Ellis, et al., “A Behavioral Approach to Worm Detection”, WORM'04, Oct. 29, 2004 (11 pages).Applicant
Prahlad Fogla et al., “Polymorphic Blending Attacks”, In Proceedings of 15th USENIX Security Symposium, pp. 241-256, (2006).Applicant
Jan Goebel, “Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation”, Hot Bots'07, Apr. 10, 2007 (14 pages).Applicant
Koral Ilgun et al., “State Trancsition Analysis: A Rule-Based Intrusion Detection Approach”, IEEE Transactions on Software Engineering, vol. 21, No. 3, pp. 181-199, Mar. 1995.Applicant
Xuxian Jiang et al., “Profiling Self-Propagating Worms via Behavioral Footprinting”, WORM'06, Nov. 3, 2006 (7 pages).Applicant
Giovanni Vigna et al., “NetSTAT: A Network-based Intrusion Detection Approach”, In Proceedings of the 14th Annual Computer Security Applications Conference (ACSAC '98), pp. 25-34, Dec. 7-11, 1998.Applicant
Kelly Jackson Higgins, “Shadowserver to Build ‘Sinkhole’ Server to Find Errant Bots: new Initiative Will Emulate IRC, HTTP Botnet Traffic”, http://darkreading.com/taxonomy/index/printarticle/id/211201241. Sep. 24, 2008 (2 pages).Applicant
Kelly Jackson Higgins, “Hacking a New DNS Attack: DNS Expert Disputes Georgia Tach and Google Research That Points to Malicious Deployment of Certain Types of DNS Servers”, http://darkreading.com/taxonomy/index/printarticie/id/208803784. Dec. 18, 2007 (2 pages).Applicant
Christian Kreibich, “Honeycomb: Automated Signature Creation Using Honeypots”, http://www.icir.ong/christain/honeycomb/index.html, Mar. 26, 2007, (3 pages).Applicant
Artem Dinaburg et al., “Ether: Malware Analysis via Hardware Virtualization Extensions”. CCS'08, Oct. 27-31. 2008 (12 pages).Applicant
Paul Royal, “Alternative Medicine: The Malware Analyst's Blue Pill”, Black Hat USA 2008, Aug. 6, 2008 (33 pages).Applicant
Paul Royal, “Alternative Medicine: The Maiware Analyst's Blue Pill”, www.damballa.com/downloads/r—pubs/KrakenWhitepaper.pdf (2008) (3pages).Applicant
Robert Perdisci et al., “Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces”, USENIX Symposium on Networked Systems Design and Implementation (NSDI 2010), (2010) (16 Pages).Applicant
Christopher Kruegel et al., “Polymorphic Worm Detection using Structural Information of Executables”, RAID 2005, pp. 207-226 (2005).Applicant
Paul Vixie, “DNS Complexity”, ACM Queue, pp. 24-29, Apr. 2007.Applicant
Ke Wang et al., “Anagram: A Content Anomaly Detector Resistant to Mimicry Attack”, In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID) (2006) (20 pages).Applicant
Ke Wang et al., “Anomalous Payload-Based Worm Detection and Signature Generation”, In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID) (2005) (20 pages).Applicant
David Whyte, “Exposure Maps: Removing Reliance on Attribution During Scan Detection”, 1st USENIX Workshop on Hot Topics in Security, pp. 51-55 (2006).Applicant
Jiahai Yang et al., “CARDS: A Distributed System for Detecting Coordinated Attacks”, In Sec (2000) (10 pages).Applicant
Vinod Yegneswaran et al., “Using Honeynets for Internet Situational Awareness”, In proceedings of the Fourth Workshop on Hot Topics in Networks (HotNets IV), Nov. 2005 (6 pages).Applicant
David Dagon et al., “Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority”, In Proceedings of Network and Distributed Security Symposium (NDSS '08) (2008) (15 pages).Applicant
Dihe's IP-Index Browser, http://ipindex.homelinux.net/index.php, updated Oct. 2012 (1 page).Applicant
Shuang Hao et al., “An Internet-Wide View into DNS Lookup Patterns”, http://labs.verisign.com/projects/malicious-domain-names/white-paper/dns-imc2010.pdf (2010) (6 pages).Applicant
Thorsten Holz et al., “Measuring and Detecting Fast-Flux Service Networks”, In Proceedings of NDSS (2008) (12 pages).Applicant
Jaeyeon Jung et al., “DNS Performance and the Effectiveness of Caching”, IEEE/ACM Transactions On Networking, vol. 10, No. 5, pp. 589-603, Oct. 2002.Applicant
The Honeynet Project & Research Alliance, “Know Your Enemy: Fast-Flux Service Networks: An Ever Changing Enemy”, http://old.honeynet.org/papers/ff/fast-flux.html, Jul. 13, 2007 (10 pages).Applicant
Wessels et al., “Measurements and Laboratory Simulations of the Upper DNS Hierarchy”, In PAM (2005) (10 pages).Applicant
Joe Stewart, “Top Spam Botnets Exposed”, http://www.secureworks.com/cyber-threat-intelligence/threats/topbotnets/, Apr. 8, 2008 (11 pages).Applicant
Brett Stone-Gross et al., “Your Botnet is My Botnet: Analysis of a Botnet Takeover”, CCS'09, Nov. 9-13, 2009 (13 pages).Applicant
Sam Stover et al., “Analysis of the Storm and Nugache Trojans: P2P is here”, Login, vol. 32, No. 6, pp. 18-27, Dec. 2007.Applicant
“Storm Botnet”, http://en.wikipedia.org/wiki/Storm—botnet, Printed Jan. 29, 2013 (7 pages).Applicant
Jeff Williams, “What We Know (and Learn) for the Waldeac Takedown”, http://blogs.technet.com/b/mmpc/archive/2010/03/15/what-we-know-and-learned-from-the-waledac-takedown.aspx, Mar. 15, 2010 (2 pages).Applicant
“Trojan:Java/Boonan”, http://microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AJava%2FBoonan, Apr. 17, 2011 (5 pages).Applicant
Julia Wolf, “Technical Details of Srizbi's Domain Algorithm”, http://blog.fireeye.com/research/2008/11/technical-details-of-srizbis-domain-generation-algorithm.html, Nov. 25, 2008 (4 pages).Applicant
Sandeep Yadav et al., “Detecting Algorithmically Generated Malicious Domain Names”, In Proceedings of the 10th Annual Conference on Internet Measurement (IMC'10), pp. 48-61, Nov. 1-3, 2010.Applicant
“TEMU: The BitBlaze Dynamic Analysis Component”, http://bitblaze.cs.berkeley.edu/temu.html, printed Jan. 29, 2013 (1 page).Applicant
Paul Bacher et al., “Know Your Enemy: Tracking Botnets: Using Honeynets to Learn More About Bots”, http://www.honeynet.org/papers/bots, Aug. 10, 2008 (1 page).Applicant
Michael Bailey et al., “Automated Classification and Analysis of Internet Malware”, RAID 2007, LNCS 4637, pp. 178-197 (2007).Applicant
Paul Barham et al., “Xen and the Art of Virtualization”, SOSP'03, Oct. 9-22, 2003 (14 pages).Applicant
Ulrich Bayer et al., “TTAnalyze: A Tool for Analyzing Maiware”, In Proceedings of the 15th Annual Conference European Institute for Computer Antivirus Research (EICAR), pp. 180-192 (2006).Applicant
Fabrice Bellard, “QEMU, A Fast and Portable Dynamic Translator”, In Proceedings of the Annual Confernce on Usenix Annual Technical Conference, pp. 41-46 (2005).Applicant
Kevin Borders et al., “Siren: Catching Evasive Malware (Short Paper)”, IEEE Symposium on Security and Privacy, pp. 78-85, May 21-24, 2006.Applicant
Christopher M. Bishop, Pattern Recognition and Machine Learning (Information Science and Statistics), Springer-Verlag New York, Inc., Secauscus, NJ, USA, 2006.Applicant
Ronen Feldman et al., “The Text Mining Handbook: Advance Approaches in Analyzing Unstructured Data”, Cambridge Univ. Pr., 2007.Applicant
Michael Hale Ligh et al., “Malware Analyst's Cookbook and DVD”, Wiley, 2010.Applicant
M. Newman, “Networks: An Introduction”, Oxford University Press, 2010.Applicant
Matt Bishop, “Computer Security: Art and Science”, Addison-Wesley Professional, 2003.Applicant
Neils Provos et al., “Virtual Honeypots: Form Botnet Tracking to Intrusion Detection”, Addison-Wesley Professional, Reading, 2007.Applicant
Michael Sipser, “Introduction to the Theory of Computation”, International Thomson Publishing, 1996.Applicant
Peter Szor, “The Art of Computer Virus Research and Defense”, Addison-Wesley Professional, 2005.Applicant
Anil K. Jain et al., “Algorithms for Clustering Data”, Prentice-Hall, Inc., 1988.Applicant
V. Laurikari, “TRE”, 2006 (5 pages).Applicant
P. Porras, “Inside Risks: Reflections on Conficker”, Communications of the ACM, vol. 52. 10, pp. 23-24, Oct. 2009.Applicant
Changda Wang et al., “The Dilemma of Covert Channels Searching”, ICISC 2005, LNCS 3935, pp. 169-174, 2006.Applicant
C. Willems et al., “Toward Automated Dynamic Malware Analysis Using CWSandbox”, IEEE Security and Privacy, vol. 5, No. 2, pp. 32-39, 2007.Applicant
R Developmental Core Team, “R: A Language and Environment for statistical Computing”, R. Foundation for Statistical Computing, Vienna Austria, 2008.Applicant
Simon Urbanek, “rJava: Low-Level-R to Java Interface”, printed May 6, 2013 (5 pages).Applicant
Juan Caballero et al., “Polyglot: Automatic Extraction of Protocol Message Format Using Dynamic Binary Analysis”, In Proceedings of ACM Conference on Computer and Communication Security, Oct. 2007 (15 pages).Applicant
Mihai Christodorescu et al., “Semantics-Aware Malware Detection”, In Proceeding of the 2005 IEEE Symposium on Security and Privacy pp. 32-46 (2005).Applicant
Mihai Christodorescu et al., “Mining Specifications on Malicious Behavior”, ESEC/FSE'07, Sep. 3-7,2007 (10 pages).Applicant
Peter Ferrie, “Attacks on Virtual Machine Emulators”, Symantec Advance Threat Research, 2006 (13 pages).Applicant
Peter Ferrie, “Attacks on More Virtual Machine Emulators”, Symantec Advance Threat Research, http://pferrie.tripod.com/papers/attacks2.pdf, 2007 (17 pages).Applicant
Tal Garfinkel et al., “A Virtual Machine Introspection Based Architecture for Intrusion Detection”, In Proceedings of Network and Distributed Systems Security Symposium, Feb. 2003 (16 pages).Applicant
G. Hunt et al., “Detours: Binary Interception of WIN32 Functions”, Proceedings of the 3rd USENIX Windows NT Symposium, Jul. 12-13, 1999 (9 pages).Applicant
Xuxian Jiang et al., “Stealthy Malware Detection Through VMM-Based “Out-of-the-Box” Semantic View Reconstruction”, CCS'07, Oct. 29-Nov. 2, 2007 (11 pages).Applicant
Xuxian Jiang et al., “Virtual Playgrounds for Worm Behavior Investigation”, RAID 2005. LNCS 3858, pp. 1-21 (2006).Applicant
Min Gyung Kang et al., “Renovo: A Hidden Code Extract for Packed Executables”, WORM'07, Nov. 2, 2007 (8 pages).Applicant
Christopher Kruegel et al., “Detecting Kernel-Level Rootkits Through Binary Analysis”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 91-100, Dec. 2004.Applicant
Lorenzo Martignoni et al., “OmniUnpack: Fast, Generic, and Safe Unpacking of Malware”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 431-441 (2007).Applicant
Thomas Raffetseder et al., “Detecting System Emulators”, In ISC, pp. 1-18 (2007).Applicant
Paul Royal et al., “PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 289-300 (2006).Applicant
Rich Uhlig et al., “Intel Virualization Technology”, Computer, vol. 38, No. 5, pp. 48-56, May 2005.Applicant
Amit Vasudevan et al., “Stealth Breakpoints”, In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC), pp. 331-392, (2005).Applicant
Amit Vasudevan et al., “Cobra: Fine-Grained Malware Analysis Using Stealth Localized-Executions”, In Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), pp. 264-279 (2006).Applicant
Yi-Min Wang et al., “Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities”, In NDSS'06,(2006) (15 pages).Applicant
Heng Yin et al., “Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis”, In Proceedings of ACM Conference on Computer and Communication Security, Oct. 29-Nov. 2, 2007 (13 pages).Applicant
Joanna Rutkowska, “Introducing Blue Pill”, http://theinvisbilethings.blogspot.com/2006/06/introducing-blue-pill.html, Jun. 22, 2006.Applicant
Peter Ferrie, “Anti-Unpacker Tricks”, In Proceedings of the 2nd International CARO Workshop (2008) (25 pages).Applicant
Danny Quist, “Covert Debugging Circumventing Software Armoring Techniques”; In Proceedings of Black Hat USA 2007 (26 pages).Applicant
Ulrich Bayer at al , “Scalable, Behavior-Based malware Clustering”, In Network and Distributed System Security Symposium (2009) (18 pages).Applicant
David Brumley et al., “Automatically Identifying Trigger-Based Behavior in Malware”, Botnet Detection, pp. 1-24 (2008).Applicant
Dancho Danchev, “Web Based Botnet Command and Control Kit 2.0”, http://ddanchev.blogspot.com/2008/08/web-based-botnet-command-and-control.html, Aug. 22, 2008 (5 pages).Applicant
Ozgun Erdogan et al., “Hash-AV: Fast Virus Signature matching by Cache-Resident Filters”, Int. J. Secur. Netw., vol. 2, pp. 50-59 (2007).Applicant
Fanglu Guo et al., “A Study of the Packer Problem and Its Solutions”, In Recent Advances in Intrusion Detection (RAID 2008), LNCS 5230, pp. 95-115 (2008).Applicant
Maria Halkidi et al., “On Clustering Validation Techniques”, Journal of Intelligent Information Systems, vol. 17, pp. 107-145 (2001).Applicant
A.K. Jain et al., “Data Clustering: A Review”, ACM Computing Surveys, vol. 31, No. 3, pp. 264-323, Sep. 1999.Applicant
John P. John et al., “Studying Spamming Botnets using Botlab”, In Usenix Symposium on Networked Systems Design and Implementation (NDSI), (2009) (16 pages).Applicant
Hyang-Ah Kim et al., “Autograph: Toward Automated, distributed Worm Signature Detection”, In USENIX Security Symposium (2004) (16 pages).Applicant
Clemens Kolbitsch et al., “Effective and Efficient Malware Detection at the End Host”, In 18th USENIX Security Symposium, pp. 351-366 (2009).Applicant
Kevin Borders et al., “Protecting Confidential Data on Personal Computers with Storage Capsules”, In 18th Usenix Security Symposium , pp. 367-382 (2009).Applicant
Ralf Hund et al., “Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms”, In 18th Usenix Security Symlposium, pp. 383-398 (2009).Applicant
Christian Kreibich et al., “Honeycomb—Creating Intrusion Detection Signatures Using Honeypots”, In ACM Workshop on Hot Topics in Networks (2003) (6 pages).Applicant
Zhichun Li et al., “Hamsa: Fast Signature Generated for Zero-Day Polymorphic Worms Provable Attack Resilience”, In IEEE Symposium on Security and Privacy (2006) (15 pages).Applicant
James Newsome et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In IEEE Symposium on Security and Privacy (2005) (16 pages).Applicant
Sun Wu et al., “AGREP—A Fast Approximate Pattern-Matching Tool”, In Usenix Technical Conference (1992) (10 pages).Applicant
Vinod Yegneswaren et al.,, “An Architecture for Generating Semantics-Aware Signatures”, In Usenix Security Symposium (2005) (16 pages).Applicant
Jaeyeon Jung, “Fast Portscan Detection Using Sequential Hypothesis Testing”, In Proceedings of IEEE Symposium on Security Privacy, pp. 211-225 (2004).Applicant
Anestis Karasaridis et al., “Wide-Scale Botnet Detection and Characterization”, In Usenix Workshop on Hot Topics in Understanding Botnets (HotBots'07 ), Apr. 11-13, 2007 (9 pages).Applicant
Carl Livades et al., “Using Machine Learning Techniques to identify Botnet Traffic”, In 2nd IEEE LCN Workshop on Network Security (WoNS'2006), pp. 967-974 (2006).Applicant
“CVE-2006-3439”, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3439, printed Jun. 27, 2012 (2 pages).Applicant
David Moore, “Inferring Internet Denial-of-Service Activity”, In Proceedings of the 10th Usenix Security Symposium, Aug. 13-17, 2001 (15 pages).Applicant
Peng Ning et al., “Constructing Attack Scenarios Through Correlation of Intrusion Alerts”, In Proceedings of Computer and Communications Security (CCS'02), Nov. 18-22, 2002 (10 pages).Applicant
Vern Paxson, “Bro: A System for Detecting Network Intruders in Real-Time”, In Proceedings of the 7th Usenix Security Symposium, Jan. 26-29, 1998 (22 pages).Applicant
Roberto Perdisci et al., “Using an Ensemble of One-Class SVM Classifiers to Harden Payload-Based Anomaly Detection Systems”, In Proceedings of the 6th International Conference on Data Mining (ICDM'06), pp. 488-498, Dec. 2006.Applicant
Phillip A. Porras, “Privacy-Enabled Global Threat Monitoring”, IEEE Security & Privacy, pp. 60-63 (2006).Applicant
Moheeb Abu Rajab et al., “A Multifaceted Approach to Understanding the Botnet Phenomenon”, In Proceedings of the ACM SIGCOMM/USENIX Internet Measurement Conference (ICM`06), Oct. 25-27, 2006 (12 pages).Applicant
Anirudh Ramachandran et al., “Understanding the Network-Level Behavior of Spammers”, In Proceedings of the 2006 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM'06), Sep. 11-16, 2006 (13 pages).Applicant
Martin Roesch, “SNORT—Lightweight Intrusion Detection for Networks”, In Proceedings of 13th System Administration Conference (LISA'99), pp. 229-238, Nov. 7-12, 1999.Applicant
Robin Sommer et al., “Enhancing Byte-Level Network Intrusion Detection Signatures with Context”, In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS'03), pp. 262-271, Oct. 27-30, 2003.Applicant
“W32/IRCBot-TO”, http://www.sophos.com/virusinfo/analyses.w32ircbotto.html, Jan. 19, 2007 (1 page).Applicant
Stuart Staniford et al., “Practical Automated Detection of Stealthy Portscans”, Journal of Computer Security, vol. 10, pp. 105-136 (2002).Applicant
S. Staniford-Chen et al., “GrIDS—A Graph Based Intrusion Detection System for Large Networks”, In Proceedings of the 19th National Information Systems Security Conference, pp. 361-370 (1996).Applicant
Steven J. Templeton et al., “A Requires/Provides Model for Computer Attacks”, In Proceedings of the 2000 Workshop on New Security Paradigms (NSPW'00), pp. 31-38 (2000).Applicant
Alfonso Valdes et al., “Probabilistic Alert Correlation”, In Proceedings of the Recent Attack in Intrusion Detection (RAID 2001), LNCS 2212, pp. 54-68 (2001).Applicant
Fredrik Valeur et al., “A Comprehensive Approach to Intrusion on Detection Alert Correlation”, IEEE Transactions on Dependable and Secure Computing, vol. 1, No. 3, pp. 146-169, Jul. 2004.Applicant
Kjersti Aas et al., “Text Categorisation: A Survey”, Norwegian Computing Center, Jun. 1999 (38 pages).Applicant
M. Andrews, “Negative Caching of DNS Queries (DNS NCACHE)”, http://tools.ietf.org/html/rfc2308, Mar. 1998 (20 pages).Applicant
Simon Biles, “Detecting the Unknown with Snort and Statistical Packet Anomaly Detecting Engine”, www.cs.luc.edu/˜pld/courses/447/sum08/class6/biles.spade.pdf (2003) (9 pages).Applicant
James Newsome et al., “Paragraph: Thwarting Signature Learning by Training Maliciously”, In Recent Advance in Intrusion Detection (RAID), 2005 (21 pages).Applicant
Jon Oberheide et al., “CloudAV: N-Version Antivirus in the Network Cloud”, In Proceedings of the 17th USENIX Security Symposium, pp. 91-106 (2008).Applicant
Dan Pelleg et al., “X-Means: Extending K-Means with Efficient Estimation of the Number of Clusters”, In International Conference on Machine Learning (2000) (8 pages).Applicant
Roberto Perdisci et al., “Misleading Worm Signature Generators Using Deliberate Noise Injection”, In IEEE Symposium on Security and Privacy (2006) (15 pages).Applicant
Mark Felegyhazi et al., “On the Potential of Proactive Domain Blacklisting”, In the Third Usenix LEET Workshop (2010) (8 pages).Applicant
Konrad Rieck et al., “Learning and Classification of Malware Behavior”, DIMVA 2008, LNCS 5137, pp. 108-125 (2008).Applicant
Sumeet Singh et al., “Automated Worm Fingerprinting”, In ACM/USENIX Symposium on Operating System Design and Implementation, Dec. 2004 (16 pages).Applicant
“EFnet Chat Network”, http://www.efnet.org, dated Jun. 18, 2007 (3 pages).Applicant
Guofei Gu et al., “Bothunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation”, Proceedings of 16th USENIX Security Symposium, pp. 167-182 (2007).Applicant
The Conficker Working final Group, “Conficker Working Group: Lessons Learned”, Conficker—Working—Group—Lessons—Learned—17—June—2010—final.pdf, published Jan. 2011 (59 pages).Applicant
Manos Antonakakis et al., “The Command Structure of the Aurora Bonet”, http://www.damballa.com/downloads/r—pubs/Aurora—Botnet—Command—Structure.pdf, 2010 (31 pages).Applicant
R. Arends et al., “Protocol Modifications for the DNS Security Extensions”, htp://www.ietf.org/rfc/rfc4035.txt, Mar. 2005 (50 pages).Applicant
R. Arends et al., “DNS Security Introduction and Requirements”, htp://www.ietf.org/rfc/rfc4033.txt, Mar. 2005 (20 pages).Applicant
R. Arends et al., “Resource Records for the DNS Security Extensions”, htp://www.ietf.org/rfc/rfc4034.txt, Mar. 2005 (28 pages).Applicant
Andreas Berger et al., “Assessing the Real-World Dynamics in DNS”, Lecture Notes in Computer Science, vol. 7189, pp. 1-14 (2012).Applicant
Global Research & Analysis Team (GReAT), “Full Analysis of Flame's Command & Control Servers”, http://www.securelist.com/en/blog/750/Full—Analysis—of—Flames—Command—Control—Servers, Sep. 17, 2012 (10 pages).Applicant
Nicolas Failiere et al., “W32.Stuxnet Dossier”, http://www.symantec.com/content/en/us/enterprise/media/security—response/whitepapers/w32—stuxnet—dossier.pdf, Feb. 2011 (69 pages).Applicant
Steinar H. Gunderson, “Global IPv6 Statistics: Measuring the Current State of IPv6 for Ordinary Users”, http://meetings.ripe.net/ripe-57/presentations/Colitti-Global—IPv6—statistics—-—Measuring—the—current—state—of—IPv6—for—ordinary—users—.7gzD.pdf, Oct. 24-30, 2008 (20 pages).Applicant
Jaeyeon Jung et al., “Modeling TTL-Based Internet Caches”, IEEE INFOCOM 2003, pp. 417-426, Mar. 2003.Applicant
Srinivas Krishnan et al., “DNS Prefetching and Its Privacy Implications: When Good Things Go Bad”, In Proceeding of the 3rd USENIX Conference on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More (LEET'10), (2010) (9 pages).Applicant
Zhuoqing Morley Mao et al., “A Precise and Efficient Evaluation of the Proximity Between Web Clients and Their Local DNS Servers”, In Proceedings of USENIX Annual Technical Conference (2002) (14 pages).Applicant
Mozilla Foundation, “Public Suffix List”, http://publicsuffix.org/, printed May 23, 2013 (8 pages).Applicant
David Plonka et al., “Context-Aware Clustering of DNS Query Traffic”, In Proceedings of the 8th IMC (2008) (13 pages).Applicant
RSA FraudAction Research Labs, “Anatomy of an Attack”, http://blogs/rsa.co,/rivner/anatomy-of-an-attack/, Apr. 1, 2011 (17 pages).Applicant
Steve Souders, “Sharing Dominant Domains”, http://www.stevesouders.com/blog/2009/05/12/sharding-dominant-domains, May 12, 2009 (3 pages).Applicant
Paul Vixie, “What DNS Is Not”, Communications of the ACM, vol. 52, No. 12, pp. 43-47, Dec. 2009.Applicant
N. Weaver et al., “Redirecting DNS for ADS Free and Profit”, In USENIX Workshop on Free and Open communications on the Internet (FOCI), Aug. 2011 (6 pages).Applicant
Florian Weimer, “Passive DNS Replication”, In Proceedings of the 17th Annual FIRST Conference on Computer Security Incident, Apr. 2005 (13 pages).Applicant
Manos Antonakakis et al., “Unveiling the Network Criminal Infrastructure of TDSS/TDL4”, http://www.damballa.com/downloads/r—pubs/Damballa—tdss—tdl4—case—study—public.pdf. (undated) (16 pages).Applicant
Manos Antonakakis et al., “From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware”, In Proceedings of the 21st USENIX Conference on Security Symposium (Security'12), (2012) (16 pages).Applicant
T. Berners-Lee et al., “RFC3986—Uniform Resource Identifier (URI): Generic Syntax”, http://www.hjp.at/doc/rfc/rfc3986.html, Jan. 2005 (62 pages).Applicant
Juan Caballero et al., “Measuring Pay-Per-Install: The Commoditization of malware Distribution”, In Proceedings of the 20th USENIX Conference on Security (SEC'11), (2011) (16 pages).Applicant
Chih-Chung Chang et al., “LIBSVM: A Library for Support Vector Machines” ACM Transactions on Intelligent System and Technology 2011, Last Updated Jun. 14, 2007 (26 pages).Applicant
Dancho Danchev, “Leaked DIY Malware Generating Tool Spotted in the Wild”, http://blog.webroot.com/2013/01/18/leaked-diy-malware-generating-tool-spotted-in-the-wild/, Jan. 18, 2013 (6 pages).Applicant
D. De La Higuera et al., “Topology of Strings: Median String is NP-Complete”, Theoretical Computer Science, vol. 230, pp. 39/48 (2000).Applicant
Robert Edmonds, “ISC Passive DNS Architecture”, http://kb.isc.org/getAttach/30/AA-00654/passive-dns-architecture.pdf, Mar. 2012 (18 pages).Applicant
Manuel Egele et al., “A Survey on Automated Dynamic Malware-Analysis Techniques and Tools”, ACM Computing Surveys, vol. 44, No. 2, Article 6, pp. 6:1-6:42, Feb. 2012.Applicant
Dennis Fisher, “Zeus Source Code Leaked”, http://threatpost.com/en—us/blogs/zeus-source-code-leaked-051011, May 10, 2011 (6 pages).Applicant
Guofei Gu et al., “BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic”, In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), Feb. 2008 (18 pages).Applicant
Grefoire Jacob, “Jackstraws: Picking Command and Control Connections from Bot Traffic”, In Proceedings of the 20th USENIX Conference on Security (SEC'11) (2011) (16 pages).Applicant
Jiyong Jang et al., “Bitshred: Feature Hashing Malware for Scalable Triage and Semantic Analysis”, In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), pp. 309-320, Oct. 17-21, 2011.Applicant
J. Zoo Kolter et al., “Learning to Detect and Classify Malicious Executables in the Wild”, Journal of Machine Learning Research, vol. 7, pp. 2721-2744, Dec. 2006.Applicant
John C. Platt, “Probablistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods”. Advances in Large margin Classifiers, vol. 10, No. 3, pp. 61-74, Mar. 26, 1999.Applicant
Team Cymru, “Developing Botnets”, http://www.team-cymru.com/ReadingRoom/Whitepapers/2010/developing-botnets.pdf (2010) (3 pages).Applicant
Brett Stone-Gross et al., “Pushdo Downloader Variant Generating Fake HTTP Requests”, http://www.secureworks.com/cyber-threat-intelligence/threats/Pushdo—Downloader—Variant—Generating—Fake—HTTP—Requests/, Aug. 31, 2012 (4 pages).Applicant
Peter Wurzinger et al., “Automatically Generting Models of Botnet Detection”, In Proceedings of the 14th European Conference on Research in Computer Security (ESORICS'09), pp. 232-249 (2009).Applicant
Yinglian Xie et al., “Spamming Botnet: Signatures and Characteristics”, In Proceeding of the ACM SIGCOMM 2008 Conference on Data Communications (SIGCOMM'08), pp. 171-182, Aug. 17-22, 2008.Applicant
Yajin Zhou et al., “Dissecting Android Malware: Characterization and Evolution”, 2012 IEEE Symposium On Security and Privacy, pp. 95-109 (2012).Applicant
Nello Cristianini et al., “An Introduction to Support Vector Machines: and other Kernal-Based Learning Methods”, Cambridge University Press, New York, NY, USA (2000).Applicant
Timo Sirainen, “IRSSI”, http://en.wikipedia.org/wiki/Irssi, updated May 8, 2013 (3 pages).Applicant
Team Cymru, “IP to ASN Mapping”, http://www.team-cymru.org/Services/ip-to-asn.html, printed Mar. 23, 2013 (6 pages).Applicant
http://www.bleedingsnort.com, retrieved from Internet Archive on May 23, 2013 Archived Sep. 26, 2006 (3 pages).Applicant
http://www.dshield.org, retrieved from Internet Archive on May 23, 2013 Archived Sep. 29, 2005 (2 pages).Applicant
http://www.alexa.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 25, 2006 (3 pages).Applicant
http://sie.isc.org/, retrieved from Internet Archive on May 23, 2013, Archived Dec. 29, 2008 (2 pages).Applicant
http://damballa.com, retrieved from Internet Archive on May 23, 2013, Archived Jan. 28, 2007 (10 pages).Applicant
http://wwe.dnswl.org, retrieved from Internet Archive on May 23, 2013, Archived Jul. 15, 2006 (4 pages).Applicant
http://www.spamhaus.org/sb1/, retrieved from Internet Archive on May 23, 2013, Archived Sep. 24, 2006 (24 pages).Applicant
http://malwaredomains.com, retrieved from Internet Archive on May 23, 2013, Archived Dec. 28, 2007 (12 pages).Applicant
http://www.opendns.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 9, 2006 (25 pages).Applicant
https://zeustracker.abuse.ch, retrieved from Internet Archive on May 23, 2013, Archived Oct. 26, 2010 (37 pages).Applicant
http://www.threatfire.com, retrieved from Internet Archive on May 23, 2013, Archived Aug. 22, 2007 (18 pages).Applicant
http://www.avira.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 29, 2006 (13 pages).Applicant
https://alliance.mwcollect.org, retrieved from Internet Archive on May 23, 2013, iArchived Jan. 7, 2007 (2 pages).Applicant
http://malfease.oarci.net, retrieved from Internet Archive on May 23, 2013, Archived Apr. 12, 2008 (1 pages).Applicant
http://www.oreans.com/themida.php, retrieved from Internet Archive on May 23, 2013, Archived Aug. 23, 2006 (12 pages).Applicant
http://www.vmware.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 26, 2006 (32 pages).Applicant
Thomas Ptacek, “Side-Channel Detection Attacks Against Unauthorized Hypervisors”, http://www.matasano.com/log/930/side-channel-detection-attacks-against-unauthorized-hypervisors/, Aug. 20, 2007, retrieved from Internet Archive on May 23, 2013, Archived Aug. 27, 2007 (12 pages).Applicant
http://cyber-ta.org/releases/botHunter/index.html, retrieved from Internet Archive on May 23, 2013, Archived Aug. 30, 2007 (6 pages).Applicant
http://anubis.seclab.tuwien.ac.at, retrieved from Internet Archive on May 23, 2013, Archived Apr. 9, 2008 (2 pages).Applicant
http://www.siliconrealms.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 4, 2006 (12 pages).Applicant
http://bitblaze.cs.berkeley.edu, retrieved from Internet Archive on May 23, 2013, Archived Jan. 28, 2008 (4 pages).Applicant
http://www.dyninst.org, retrieved from Internet Archive on May 23, 2013, Archived Aug. 20, 2006 (pages).Applicant
http://www.peid.info, retrieved from Internet Archive on May 23, 2013, Archived Dec. 4, 2007 (2 pages).Applicant
Mark Russinovich et al., “RegMon for Windows V7.04”, http://technet.microsoft.com/en-us/sysinternals.bb896652.aspx, Published Nov. 1, 2006 (4 pages).Applicant
“Troj/Agobot-IB”, http://www.sophos.com/virusinfo/analyses/trojagobotib.html, pnnted Jun. 27, 2012 (1 page).Applicant
Mark Russinovich et al., “FileMon for Windows V7.04”, http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx, Nov. 1, 2006 (6 pages).Applicant
“Norman Sandbox Whitepaper”, Copyright Norman 2003 (19 pages).Applicant
Tanveer Alam et al., “Webinar: Intel Virtuallzation Technology of Embedded Applications”, Intel, Copyright 2010 (34 pages).Applicant
F. Heinz et al., “IP Tunneling Through Nameserver”, http://slashdot.org/story/00/09/10/2230242/ip-tunneling-through-nameservers, Sep. 10, 2000 (23 Pages).Applicant
http://www.mcafee.com/us/, printed May 23, 2013 (23 pages).Applicant
“Windows Virtual PC”, http://en.wikipedia.org/wiki/Windows—Virtual—PC, Last Modified May 5, 2013, Printed May 23, 2013 (21 pages).Applicant
Par Fabien Perigaud, “New Pill?”, http://cert.lexsi.com/weblog/index.php/2008/03/21/223-new-pill, Mar. 21, 2008 (3 pages).Applicant
http://handlers.sans.org/jclausing/userdb.txt, printed May 24, 2013 (149 pages).Applicant
Avi Kivity et al., “KVM: The Linux Virtual Machine Monitor”, Proceedings of the Linux Symposium, pp. 225-230, Jun. 27-30, 2007.Applicant
Symantec, “Symantec Global Internet Security Threat Report: Trends for 2008”, vol. XIV, Apr. 2009 (110 pages).Applicant
File History of U.S. Appl. No. 12/538,612.Applicant
File History of U.S. Appl. No. 13/205,928.Applicant
File History of U.S. Appl. No. 11/538,212.Applicant
File History of U.S. Appl. No. 12/985,140.Applicant
File History of U.S. Appl. No. 13/008,257.Applicant
File History of U.S. Appl. No. 13/309,202.Applicant
File History of U.S. Appl. No. 13/749,205.Applicant

Abstract

Description

Cross-Reference to Related Applications

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 61/438,492, filed Feb. 1, 2011, which is incorporated by reference in its entirety.

Brief Description of the Figures

[0002] FIGS. 1-3 illustrate details related to a system for detecting a malicious domain name, according to one embodiment.

[0003] FIG. 4 illustrates a method for detecting a malicious domain name, according to one embodiment.

[0004] FIG. 5 illustrates details of how domain name statistical information can be collected, according to one embodiment.

Brief Description of Embodiments of the Invention

Requester Diversity Vector: 227 82 23 557 659 28.652173913 62.0934842839 3855.60079051 8.03658536585 18.1526076227 329.517163505 2.90308370044 4.88354100521 23.8489727496

Requester Profile Vector: 81.2208888635 689.103419745 688.485666667 474863.523104 474012.513206 638.422939068 1095.02680602 1094.0451592 1095.02680602 1199083.7059

Requester Reputation Vector: 0.0 0.0 16.0 0.0 0.0 0.0 0.0 0.0 294.0

[i: ‘2010-05-21’, ii: ‘imddos.my03.com’, iii: ‘black’, iv: ‘black’, v: ‘unknown’, vi: 0.80000000000000004],

[0022] Requester Diversity.

[0024] In the example of imddos.my03.com for the day of May 21, 2010, the requester diversity vector can be:

cidr_div: 227

as_div: 82

cc_div: 23

rdns_cnt: 557

overall_cnt: 659

cc_avg: 28.652173913

cc_std: 62.0934842839

cc_var: 3855.60079051

asn_avg: 8.03658536585

asn_std: 18.1526076227

asn_var: 329.517163505

cidr_avg: 2.90308370044

cidr_std: 4.88354100521

cidr_var: 23.8489727496°

[0026] Requester Profile.

[0029]

w_{t, k} = \frac{c_{t, k}}{\max_{l - t}^{\langle R \rangle} C_{t, l}} .

[0031] In the example of imddos.my03.com for the day of May 21, 2010, the un-weighted requester profile vector can be:

Cav: 638.422939068

Cstd: 1095.02680602

Cstdpop: 1094.0451592

Cstdsamp: 1095.02680602

Cvar: 1199083.7059

[0034] In the example of imddos.my03.com for the day of May 21, 2010, the weighted requester profile vector can be:

Weighted Cav: 81.2208888635

Weighted Cstd: 689.103419745

Weighted Cstdpop: 688.485666667

Weighted Cvar: 474863.523104

Weighted Cvarpop: 474012.513206

[0035] The weighted features can follow the same logic described above, with each feature being multiplied by the previous described weighting factor (WC_t(d)).

[0036] Requester Reputation.

- [0039] Malware Evidence. Malware evidence can help determine whether a piece of malware can be linked with a particular network address space. Malware evidence can include the average number of known malicious domain names that in a certain epoch of time have pointed to each of the IP addresses in IPs(d, t), each of the BGP prefixes in BGP(d, t), or each of the AS numbers in AS(d, t), or any combination thereof, that are on a malware list.
- [0040] SBL Evidence. Spamhouse Block List (SBL) evidence (e.g., see www.spamhaus.org/sbl) can help show if a particular address space has historically been linked with fraudulent activities (e.g., spamming, phishing). SBL evidence can also include the average number of known malicious domain names that in a certain epoch of time have pointed to each of the IP addresses in IPs(d, t), each of the BGP prefixes in BGP(d, t), or each of the AS numbers in AS(d, t), or any combination thereof, that are on a SBL list.
- [0041] Whitelist Evidence. The number of IP addresses in IPs(d, t), the BGP prefixes in BGP(d, t), and the AS numbers in AS(d, t) that include IP addresses pointed to by domain names in all or part of certain white lists (e.g., DNSWL, ALEXA) can be determined.

[0042] For the example of imddos.my03.com for the day of May 21, 2010, the requester reputation vector can be:

botipcAV: 0.0

botcidrcAV: 0.0

botascAV: 16.0

sblipcAV: 0.0

sblcidrcAV: 0.0

sblascAV: 0.0

whipcAV: 0.0

whcidrcAV: 0.0

whascAV: 294.0

Claims

The invention claimed is:

1. A method for detecting a malicious domain name, comprising:

2. The method of claim 1, wherein the domain name statistical information comprises requester diversity information, or requester profile information, or both.

3. The method of claim 2, wherein the domain name statistical information also comprises reputation information.

4. The method of claim 3, wherein the reputation information classifies a domain name as malignant or benign utilizing historic information about domain name resolution.

5. The method of claim 2, wherein the requester diversity information comprises diversity in terms of a network location of the recursive device that queries a domain name.

6. The method of claim 2, wherein the requester profile information comprises a level of popularity of the querying recursive device that queries a domain name.

7. The method of claim 1, further comprising:

8. The method of claim 7, wherein the additional domain name is a new domain name.

9. The method of claim 1, wherein collecting domain name information from the non-RDNS NS comprises monitoring DNS traffic flowing towards the non-RDNS NS.

11. The method of claim 1, wherein a sensor is attached to or by the non-RDNS NS.

12. The method of claim 1, wherein a DNS operator is able to detect and remediate a malicious domain name within his or her name space.

13. A system for detecting a malicious domain name, comprising:

a processing device configured for:

14. The system of claim 13, wherein the domain name statistical information comprises requester diversity information, or requester profile information, or both.

15. The system of claim 14, wherein the domain name statistical information also comprises reputation information.

16. The system of claim 15, wherein the reputation information classifies a domain name as malignant or benign utilizing historic information about domain name resolution.

17. The system of claim 14, wherein the requester diversity information comprises diversity in terms of network location of the recursive device that queries a domain name.

18. The system of claim 14, wherein the requester profile information comprises a level of popularity of the querying recursive devices that queries a domain name.

19. The system of claim 13, further comprising:

20. The system of claim 19, wherein the additional domain name is a new domain name.

21. The system of claim 13, wherein collecting domain name information from the non-RDNS NS comprises monitoring DNS traffic flowing towards the non-RDNS NS.

23. The system of claim 13, wherein a sensor is attached to or by the non-RDNS NS.

24. The system of claim 13, wherein a DNS operator is able to detect and remediate a malicious domain name within his or her name space.

Patent Citations (147)

Patent	Date	Inventor	Cited By
US4843540(A)	1989-06-01	Stolfo	Applicant
US4860201(A)	1989-08-01	Stolfo et al.	Applicant
US5363473(A)	1994-11-01	Stolfo et al.	Applicant
US5497486(A)	1996-03-01	Stolfo et al.	Applicant
US5563783(A)	1996-10-01	Stolfo et al.	Applicant
US5668897(A)	1997-09-01	Stolfo	Applicant
US5717915(A)	1998-02-01	Stolfo et al.	Applicant
US5748780(A)	1998-05-01	Stolfo	Applicant
US5920848(A)	1999-07-01	Schultzer et al.	Applicant
US6401118(B1)	2002-06-01	Thomas	Applicant
US6983320(B1)	2006-01-01	Thomas et al.	Applicant
US7013323(B1)	2006-03-01	Thomas et al.	Applicant
US7039721(B1)	2006-05-01	Wu et al.	Applicant
US7069249(B2)	2006-06-01	Stolfo et al.	Applicant
US7093292(B1)	2006-08-01	Pantuso	Applicant
US7136932(B1)	2006-11-01	Schneider	Examiner
US7152242(B2)	2006-12-01	Douglas	Applicant
US7162741(B2)	2007-01-01	Eskin et al.	Applicant
US7225343(B1)	2007-05-01	Honig et al.	Applicant
US7277961(B1)	2007-10-01	Smith et al.	Applicant
US7331060(B1)	2008-02-01	Ricciulli	Applicant
US7372809(B2)	2008-05-01	Chen et al.	Applicant
US7383577(B2)	2008-06-01	Hrastar et al.	Applicant
US7424619(B1)	2008-09-01	Fan et al.	Applicant
US7426576(B1)	2008-09-01	Banga et al.	Applicant
US7448084(B1)	2008-11-01	Apap et al.	Applicant
US7483947(B2)	2009-01-01	Starbuck	Applicant
US7487544(B2)	2009-02-01	Schultz et al.	Applicant
US7536360(B2)	2009-05-01	Stolfo et al.	Applicant
US7634808(B1)	2009-12-01	Szor	Applicant
US7639714(B2)	2009-12-01	Stolfo et al.	Applicant
US7657935(B2)	2010-02-01	Stolfo et al.	Applicant
US7665131(B2)	2010-02-01	Goodman	Applicant
US7698442(B1)	2010-04-01	Krishnamurthy	Applicant
US7752125(B1)	2010-07-01	Kothari et al.	Applicant
US7752665(B1)	2010-07-01	Robertson et al.	Applicant
US7779463(B2)	2010-08-01	Stolfo et al.	Applicant
US7784097(B1)	2010-08-01	Stolfo et al.	Applicant
US7818797(B1)	2010-10-01	Fan et al.	Applicant
US7913306(B2)	2011-03-01	Apap et al.	Applicant
US7930353(B2)	2011-04-01	Chickering	Applicant
US7962798(B2)	2011-06-01	Locasto et al.	Applicant
US7979907(B2)	2011-07-01	Schultz et al.	Applicant
US7996288(B1)	2011-08-01	Stolfo	Applicant
US8015414(B2)	2011-09-01	Mahone	Applicant
US8019764(B1)	2011-09-01	Nucci	Applicant
US8074115(B2)	2011-12-01	Stolfo et al.	Applicant
US8161130(B2)	2012-04-01	Stokes	Applicant
US8224994(B1)	2012-07-01	Schneider	Examiner
US8260914(B1)	2012-09-01	Ranjan	Applicant
US8341745(B1)	2012-12-01	Chau	Applicant
US8347394(B1)	2013-01-01	Lee	Examiner
US8516585(B2)	2013-08-01	Cao et al.	Applicant
US2001/0044785(A1)	2001-11-01	Stolfo et al.	Applicant
US2001/0052007(A1)	2001-12-01	Shigezumi	Applicant
US2001/0052016(A1)	2001-12-01	Skene et al.	Examiner
US2001/0055299(A1)	2001-12-01	Kelly	Examiner
US2002/0021703(A1)	2002-02-01	Tsuchiya et al.	Applicant
US2002/0066034(A1)	2002-05-01	Schlossberg et al.	Applicant
US2003/0065926(A1)	2003-04-01	Schultz et al.	Applicant
US2003/0065943(A1)	2003-04-01	Geis et al.	Applicant
US2003/0069992(A1)	2003-04-01	Ramig	Applicant
US2003/0167402(A1)	2003-09-01	Stolfo et al.	Applicant
US2003/0204621(A1)	2003-10-01	Poletto et al.	Applicant
US2004/0002903(A1)	2004-01-01	Stolfo et al.	Applicant
US2004/0111636(A1)	2004-06-01	Baffes et al.	Applicant
US2004/0187032(A1)	2004-09-01	Gels et al.	Applicant
US2004/0205474(A1)	2004-10-01	Eskin et al.	Applicant
US2004/0215972(A1)	2004-10-01	Sung et al.	Applicant
US2005/0021848(A1)	2005-01-01	Jorgenson	Applicant
US2005/0039019(A1)	2005-02-01	Delany	Examiner
US2005/0108407(A1)	2005-05-01	Johnson et al.	Applicant
US2005/0108415(A1)	2005-05-01	Turk et al.	Applicant
US2005/0257264(A1)	2005-11-01	Stolfo et al.	Applicant
US2005/0261943(A1)	2005-11-01	Quarterman et al.	Applicant
US2005/0265331(A1)	2005-12-01	Stolfo	Applicant
US2005/0281291(A1)	2005-12-01	Stolfo et al.	Applicant
US2006/0015630(A1)	2006-01-01	Stolfo et al.	Applicant
US2006/0075084(A1)	2006-04-01	Lyon	Applicant
US2006/0143711(A1)	2006-06-01	Huang et al.	Applicant
US2006/0146816(A1)	2006-07-01	Jain	Applicant
US2006/0156402(A1)	2006-07-01	Stone et al.	Applicant
US2006/0168024(A1)	2006-07-01	Mehr	Applicant
US2006/0178994(A1)	2006-08-01	Stolfo et al.	Applicant
US2006/0212925(A1)	2006-09-01	Shull	Applicant
US2006/0224677(A1)	2006-10-01	Ishikawa et al.	Applicant
US2006/0230039(A1)	2006-10-01	Shull	Applicant
US2006/0247982(A1)	2006-11-01	Stolfo et al.	Applicant
US2006/0253584(A1)	2006-11-01	Dixon	Applicant
US2007/0050708(A1)	2007-03-01	Gupta et al.	Applicant
US2007/0064617(A1)	2007-03-01	Reves	Applicant
US2007/0083931(A1)	2007-04-01	Spiegel	Applicant
US2007/0162587(A1)	2007-07-01	Lund et al.	Applicant
US2007/0239999(A1)	2007-10-01	Honig et al.	Applicant
US2007/0274312(A1)	2007-11-01	Salmela et al.	Applicant
US2007/0294419(A1)	2007-12-01	Ulevitch	Examiner
US2008/0028073(A1)	2008-01-01	Trabe et al.	Applicant
US2008/0028463(A1)	2008-01-01	Dagon	Applicant
US2008/0060054(A1)	2008-03-01	Srivastava	Applicant
US2008/0060071(A1)	2008-03-01	Hennan	Applicant
US2008/0098476(A1)	2008-04-01	Syversen	Applicant
US2008/0133300(A1)	2008-06-01	Jalinous	Applicant
US2008/0155694(A1)	2008-06-01	Kwon et al.	Applicant
US2008/0177736(A1)	2008-07-01	Spangler	Applicant
US2008/0184371(A1)	2008-07-01	Moskovitch	Applicant
US2008/0229415(A1)	2008-09-01	Kapoor	Applicant
US2008/0262985(A1)	2008-10-01	Cretu et al.	Applicant
US2008/0263659(A1)	2008-10-01	Alme	Applicant
US2008/0276111(A1)	2008-11-01	Jocoby et al.	Applicant
US2009/0055929(A1)	2009-02-01	Lee et al.	Applicant
US2009/0083855(A1)	2009-03-01	Apap et al.	Applicant
US2009/0106304(A1)	2009-04-01	Song	Applicant
US2009/0193293(A1)	2009-07-01	Stolfo et al.	Applicant
US2009/0210417(A1)	2009-08-01	Bennett	Applicant
US2009/0222922(A1)	2009-09-01	Sidiroglou et al.	Applicant
US2009/0241191(A1)	2009-09-01	Keromytis et al.	Applicant
US2009/0254658(A1)	2009-10-01	Kamikura et al.	Applicant
US2009/0254992(A1)	2009-10-01	Schultz et al.	Applicant
US2009/0282479(A1)	2009-11-01	Smith et al.	Applicant
US2009/0327487(A1)	2009-12-01	Olson et al.	Applicant
US2010/0011243(A1)	2010-01-01	Locasto et al.	Applicant
US2010/0023810(A1)	2010-01-01	Stolfo et al.	Applicant
US2010/0031358(A1)	2010-02-01	Elovici et al.	Applicant
US2010/0054278(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0064368(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0064369(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0077483(A1)	2010-03-01	Stolfo et al.	Applicant
US2010/0138919(A1)	2010-06-01	Peng	Applicant
US2010/0146615(A1)	2010-06-01	Locasto et al.	Applicant
US2010/0153785(A1)	2010-06-01	Keromytis et al.	Applicant
US2010/0169970(A1)	2010-07-01	Stolfo et al.	Applicant
US2010/0269175(A1)	2010-10-01	Stolfo et al.	Applicant
US2010/0274970(A1)	2010-10-01	Treuhaft et al.	Examiner
US2010/0275263(A1)	2010-10-01	Bennett et al.	Applicant
US2010/0281541(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0281542(A1)	2010-11-01	Stolfo et al.	Applicant
US2010/0332680(A1)	2010-12-01	Anderson et al.	Applicant
US2011/0041179(A1)	2011-02-01	Stahlberg	Applicant
US2011/0167493(A1)	2011-07-01	Song et al.	Applicant
US2011/0167494(A1)	2011-07-01	Bowen et al.	Applicant
US2011/0185428(A1)	2011-07-01	Sallam	Applicant
US2011/0214161(A1)	2011-09-01	Stolfo et al.	Applicant
US2012/0084860(A1)	2012-04-01	Cao et al.	Applicant
US2013/0232574(A1)	2013-09-01	Carothers	Applicant
WO2/37730	2002-05-01		Applicant
WO2/098100	2002-12-01		Applicant
WO2007/050244	2007-05-01		Applicant

Non-Patent Literature (353)

Cliff Changchun Zou et al., “Code Red Worm Propagation Modeling and Analysis”, In Proceedings of 9th ACM Conference on Computer and Communications Security (CCS '02), Nov. 18, 2002.Applicant

Cliff C. Zou et al,. “Email Worm Modeling and Defense”, In the 13th ACM International Confrerence on Computer Communications and Networks (CCCN '04), Oct. 27, 2004.Applicant

Cliff Changchun Zou et al., “Monitoring and Early Warning for Internet Worms”, In Proceedings fo the 10th ACM Conference on Computer and Communications Security (CCS '03), Oct. 2003.Applicant

Cliff Changchun Zou et al., “On the Performance of Internet Worm Scanning Strategies”, Technical Report TR-03-CSE-07, Umass ECE Dept., Nov. 2003.Applicant

Alexander Gostev, “Malware Elovution: Jan.-Mar. 2005”, Viruslist.com, http.//www.viruslist.com/en/analysis?pubid=162454316, (Apr. 18, 2005).Applicant

Jiang Wu et al., “An Effective Architecture and Algorithm for Detecting Worms with Various Scan Techniques”, In Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS '04), Feb. 2004.Applicant

Matthew M. Williamson et al., “Virus Throttling for Instant Messaging”, Virus Bulletin Conference, Sep. 2004, Chicago, IL, USA, (Sep. 2004).Applicant

F. Weimer, “Passive DNS Replication”, http://www.enyo.de/fw/software/dnslogger, 2005.Applicant

Ke Wang et al., “Anomalous Payload-Based Network Intrusion Detection”, In Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004), 2004.Applicant

P. Vixie et al,. “RFC 2136: Dynamic Updates in the Domain Name System (DNS Update)”, http://www.faqs.org/rfcs.rfc2136.html (Apr. 1997).Applicant

Joe Stewart, “Dipnet/Oddbob Worm Analysis”, SecureWorks, http://www/secureworks.com/research/threats/dipnet/ (Jan. 3, 2005).Applicant

Harold Thimbleby et al., “A Framework for Modeling Trojans and Computer Virus Infection”, Computer Journal, vol. 41, No. 7, pp. 444-458 (1999).Applicant

Paul Bachner et al., “Know Your Enemy: Tracking Botnets”, http://www.honeynet.org/papers/bots/, (Mar. 13, 2005).Applicant

“LockDown Security Bulletin—Sep. 23, 2001”, http://lockdowncorp.com/bots/ (Sep. 23, 2001).Applicant

Colleen Shannon et al., “The Spread of the Witty Worm”, http://www.caida.org/analysis/security/witty/index.xml (Mar. 19, 2004).Applicant

Moheeb Abu Rajab et al., “On the Effectiveness of Distributed Worm Monitoring”, In Proceedings fo the 14th USENIX Security Symposium (2005).Applicant

Niels Provos, “CITI Technical Report 03-1: A Virtual Honeypot Framework”, http://www.citi.umich.edu/techreports/reports/citi-tr-03-1.pdf. (Oct. 21, 2003).Applicant

“Know your Enemy: Honeynets”, http://www.honeypot.org/papers/honeynet, (May 31, 2006).Applicant

David Moore et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, In Proceedings of the IEEE INFOCOM 2003, Mar. 2003.Applicant

Joe Stewart, “I-Worm Baba Analysis”, http://secureworks.com/research/threats/baba (Oct. 22, 2004.Applicant

David Moore et al., “Slammer Worm Dissection: Inside the Slammer Worm”. IEEE Security & Privacy, vol. 1, No. 4 (Jul.-Aug. 2003).Applicant

David Moore et al., “Code-Red: A Case Study on the Spread and Victims of an Internet Worm”, http://www.icir.org/vern/imw-2002/imw2002-papers/209.ps/gz (2002).Applicant

Joe Stewart, “Sinit P2P Trojan Analysis”, http://www.secureworks.com/research/threats/sinit, (Dec. 8, 2003).Applicant

Martin Krzywinski, “Port Knocking—Network Authentication Across Closed Ports”, Sys Admin Magazine, vol. 12, pp. 12-17 (2003).Applicant

Christopher Kruegel et al., “Anomaly Detection of Web-Based Attacks”, In Proceedings of the 10th ACM Conference on Computer and Communication Security (CCS '03), Oct. 27-31, 2003, Washington, DC, USA, pp. 251-261.Applicant

“Dabber Worm Analysis”, LURHQ Threat Intelligence Group, http://www.lurhq.com/dabber.html (May 13, 2004).Applicant

Abstract of Jeffrey O. Kephart et al,. “Directed-Graph Epidemiological Models of Computer Viruses”, Proceedings on the 1991 IEEE Computer Society Symposium on Research in Security and Privacy; Oakland, CA, May 20-22, 1991; pp. 343-359 (May 20-22, 1991).Applicant

C. Kalt “RFC 2810—Internet Relay Chat: Architecture” http://faqs.org/rfcs/rfc2810.html (Apr. 2000).Applicant

Xuxian Jiang et al., “Cerias Tech Report 2005-24: Virtual Playgrounds for Worm Behavior Investigation”, Purdue University, Feb. 2005.Applicant

Neal Hindocha et al., “Malicious Threats and Vulnerabilities in Instant Messaging”, Virus Bulletin International Conference, Sep. 2003.Applicant

Thomer M. Gil, “NSTX (IP-over-DNS) HOWTO”, http://thomer.com/howtos/nstx.html, Nov. 4, 2005 (5 pages).Applicant

V. Fuller et al., “RFC 1519—Classless Inter-Domain Routing (CIDR): An Address Assignment and Aggregation Strategy”, http://www.faqs.org/rfcs/rfc1519.html(Sep. 1993).Applicant

David E. Smith “Dynamic DNS”, http://www.technopagan.org/dynamic (Aug. 7, 2006).Applicant

Dave Dittrich, “Active Response Continuum Research Project”, http://staff.washington.edu/dittrich/arc/ (Nov. 14, 2005).Applicant

Joe Stewart, “Akak Trojan Analysis”, http://www.secureworks.com/research/threats/akak/ (Aug. 31, 2004).Applicant

Monirul I. Sharif, “Mechanisms of Dynamic Analysis and DSTRACE”.Applicant

Kapil Kumar Singh, “IRC Reconnaissance (IRCRecon) Public IRC Heuristics (BotSniffer)” (Jul. 24, 2006).Applicant

http://www.trendmicro.com/en/home/us/home.htm.Applicant

“InterCloud Security Service”, http://ww.trendmicro.com/en/products/nss/icss/evaluate/overview.thm.Applicant

“2006 Press Releases: Trend Micro Takes Unprecedented Approach to Eliminating Botnet Threats with the Unveiling of InterCloud Security Service”, http://www.trendmicro.com/en/about/news/pr/archive/2006/pr092506.htm, (Sep. 25, 2006).Applicant

Paul F. Roberts, “Trend Micro Launches Anti-Botnet Service”, InfoWorld, http://www.infoworid.com/article/06/09/25/HNtrendintercloud—1.html (Sep. 25, 2006).Applicant

CNN Technology News—Expert: Botnets No. 1 Emerging Internet Threat, CNN.com, http://www.cnn.com/2006/TECH/internet/01/31/furst.index.html (Jan. 31, 2006).Applicant

Evan Cooke et al., “The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets”, In USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), Jun. 2005.Applicant

Sven Dietrich et al., “Analzying Distrubuted Denial of Service Tools: The Shaft Case”, Proceedings of the 14th Systems Administration Conference (LISA 2000), New Orleans, Louisiana, USA, Dec. 3-8, 2000.Applicant

Felix C. Freiling et al,. “Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks”, ESORICS 2005, LNCS 3679, pp. 319-335 (2005).Applicant

Luiz Henrique Gomes et al., “Characterizing a Spam Traffic”, In Proc. ACM SIGCOMM Internet Measurement Conference (IMC '04), Oct. 25-27, 2004 Taormina, Sicily, Italy, pp. 356-369.Applicant

Christopher W. Hanna, “Using Snort to Detect Rogue IRC Bot Programs”, Technical Report, SANS Institute 2004 (Oct. 8, 2004).Applicant

Jaeyeon Jung et al., “An Empirical Study of Spam Traffic and the Use of DNS Black Lists”, In Proc. ACM SIGCOMM Internet Measurement Conference (IMC '04), Oct. 25-27, 2004, Taormina, Sicily, Italy, pp. 370-375.Applicant

Srikanth Kandula et al., “Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds”, Technical Report LCS TR-969, Laboratory for Computer Science, MIT, 2004.Applicant

Sven Krasser et al., “Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization”, Proceedings of the 6th IEEE Information Assurance Workshop (Jun. 2005).Applicant

David Moore et al., “Inferring Internet Denial-of-Service Activity”, In Proceedings of the 2001 USENIX Security Symposium, 2001.Applicant

Stephane Racine, “Master's Thesis: Analysis for Internet Relay Chat Usage by DDoS Zombies”, ftp://www.tik.ee.ethz.ch/pub/students/2003-2004-Wi/MA-2004-01.pdf (Nov. 3, 2003).Applicant

Anirudh Ramachandran et al., “Understanding the Network-Level Behavior of Spammers”, SIGCOMM '06, Sep. 11-15, 2006, Pisa, Italy, pp. 291-302.Applicant

Ramneek Puri, “Bots & Botnet: An Overview”, SANS Institute 2003, http://www.giac.com/practical/GSEC/Ramneek—Puri—GSEC.pdf (Aug. 8, 2003).Applicant

Stuart E. Schechter et al., “Access for Sale:A New Class of Worm”, In 2003 ACM Workshop on Rapid Malcode (WORM '03), ACM SIGSAC, Oct. 27, 2003, Washington, DC, USA.Applicant

Stuart Staniford, “How to Own the Internet in Your Spare Time”, In Proc. 11th USENIX Security Symposium, San Francisco, CA, Aug. 2002.Applicant

Martin Overton, “Bots and Botnets: Risks, Issues and Prevention”, 2005 Virus Bulletin Conference at the Burlington, Dublin, Ireland, Oct. 5-7, 2005, http://arachnid.homeip.net/papers/VB2005-Bots—and—Botnets-1.0.2.pdf.Applicant

Yin Zhang et al., “Detecting Stepping Stones”, Proceedings of the 9th USENIX Security Symposium, Denver, Colorado, USA, Aug. 14-17, 2000.Applicant

Joe Stewart, “Bobax Trojan Analysis”, http://www.lurhq.com/bobax.html, May 17, 2004.Applicant

David Brumley et al., “Tracking Hackers on IRC”, http://www.doomded.com/texts/ircmirc/TrackingHackersonIRC.htm, Dec. 8, 1999.Applicant

Brian Krebs, “Bringing Botnets Out of the Shadows”, Washingtonpost.com, http://www.washingtonpost.com/wp-dyn/content/artcile/2006/03/21/AR2006032100279—pf.html, Mar. 21, 2006.Applicant

“SwatIT: Bots, Drones, Zombies, Worms and Other Things That Go Bump in the Night”, http://swatit.org/bots, 2004.Applicant

Christian Kreibich, “Honeycomb; Automated NIDS Signature Creation Using Honeypots”, 2003, http://www.cl.cam.ac.uk/research/srg/netos/papers/2003-honeycomb-sigcomm-poster.pdf.Applicant

DMOZ Open Directory Project, Dynamic DNS Providers List, http://dmoz.org/Computers/Software/Internet/Servers/Address—Management/Dynamic—DNS—Services/.Applicant

David Moore, “Network Telescopes: Observing Small or Distant Security Events”, http://www.caida.org/publications/presentations/2002/usenix—sec/usenix—sec—2002—files/frame.htm; Aug. 8, 2002.Applicant

Vincent H. Berk et al., “Using Sensor Networks and Data Fusion for Early Detection of Active Worms”, Sensors, and Command, Control, Communications, and Intelligence (C3il) Technologies for Homeland Defense and Law Enforcement II, Proceedings of SPIE, vol. 5071, pp. 92-104 (2003).Applicant

David Dagon et al., “Worm Population Control Through Periodic Response”, Technical Report, Georgia Institute for Technology, Jun. 2004.Applicant

Scott Jones et al., “The IPM Model of Computer Virus Management”, Computers & Security, vol. 9, pp. 411-418 (1990).Applicant

Jeffrey O. Kephart et al., “Directed-Graph Epidemiological Models of Computer Viruses”, In Proceedings of IEEE Symposium on Security and Privacy, pp. 343-359 (1991).Applicant

Darrell M. Kienzle et al., “Recent Worms: A Survey and Trends”, In WORM '03, Proceedings of the 2003 ACM Workshop on Rapid Malcode, Washington, DC, USA, pp. 1-10, Oct. 27, 2003.Applicant

Bill McCarty, “Botnets: Big and Bigger”, IEEE Security and Privacy Magazine, vol. 1, pp. 87-89 (2003).Applicant

Xinzhou Qin et al., “Worm Detection Using Local Networks”, Technical Report GIT-CC-04-04, College of Computing, Georgia Institute of Technology, Feb. 2004.Applicant

Yang Wang et al., “Modeling the Effects of Timing Parameters on Virus Propagation”, In Proceedings of ACM CCS Workshop on Rapid Malcode (WORM '03), Washington, DC, pp. 61-66, Oct. 27, 2003.Applicant

Donald J. Welch et al., “Strike Back: Offensive Actions in Information Warfare”, in AMC New Security Paradigm Workshop. pp. 47-52 (1999).Applicant

T. Liston, “Welcome to my Tarpit: The Tactical and Stragetic Use of LaBrea”, http://www.hackbusters.net/LaBrea/LaBrea.txt, Oct. 24, 2001.Applicant

R. Pointer, “Eggdrop Development”, http://www.eggheads.org, Oct. 1, 2005.Applicant

S. Staniford, “Code Red Analysis Pages: July Infestation Analysis”, http://silicondefense.org/cr/july.html, Nov. 18, 2001.Applicant

Alex Ma, “NetGeo—The Internet Geographic Database”, http://www.caida.org/tools/utilities/netgeo/index.xml, Sep. 6, 2006.Applicant

MathWorks Inc. Simulink, http://www.mathworks.com/products/simulink, Dec. 31, 2005.Applicant

David Dagon et al., “Modeling Botnet Propagation Using Time Zones”, In Proceedings of the 13th Annual Network and Distributed Systems Security Symposium (NDSS '06), Feb. 2006.Applicant

John Canavan, “Symantec Security Response: W32.Bobax.D”, http://www.sarc.com/avcent/venc/data/w32.bobax.d.html, May 26, 2004.Applicant

“Whois Privacy”, www.gnso.icann.org/issues/whois-privacy/index/shtml, Jun. 3, 2005.Applicant

John D. Hardin, “The Scanner Tarpit HOWTO”, http://www.impsec.org/linus/security/scanner-tarpit.html, Jul. 20, 2002.Applicant

Charles J. Krebs, “Ecological Methodology”, Harper & Row, Publishers, New York, pp. v-x, 15-37, 155-166, and 190-194 (1989).Applicant

D.J. Daley et al., “Epidemic Modeling: An Introduction”, Cambridge University Press, pp. vii-ix, 7-15, and 27-38 (1999).Applicant

Lance Spitzner, “Honeypots: Tracking Hackers”, Addison-Wesley, pp. vii-xiv, 73-139, 141-166, and 229-276 (2003).Applicant

International Search Report issued in Application No. PCT/US06/038611 mailed Jul. 8, 2008.Applicant

Written Opinion issued in Application No. PCT/US06/038611 mailed No. PCT/US06/038611 mailed Jul. 8, 2008.Applicant

International Preliminary Report on Patentability issued in Application No. PCT/US06/038611 mailed Mar. 26, 2009.Applicant

O. Diekmann et al,. “Mathematical Epidemiology of Infectious Diseases: Model Building, Analysis and Interpretation”, John Wiley & Son, Ltd., 2000, pp. v-xv and 1-303.Applicant

Jelena Mirkovic et al,. “Internet Denial of Service: Attack and Defense Mechanisms”, Prentice Hall Professional Technical Reference, 2004, pp. v-xxii and 1-372.Applicant

“Symantec Internet Security Threat Report: Trends for Jan. 1, 2004-Jun. 30, 2004” Symantec, Sep. 2004, pp. 1-54.Applicant

David Dagon et al., “HoneyStat: 2004, Local Worm Detection Using Honeypots”, RAID 2004, LNCS 3224, pp. 39-58 (2004).Applicant

Jonghyun Kim et al., “Measurement and Analysis of Worm Propagation on Internet Network Topology”, IEEE, pp. 495-500 (2004).Applicant

Andreas Marx, “Outbreak Response Times: Putting AV to the Test”, www.virusbtn.com, Feb. 2004, pp. 4-6.Applicant

Vinod Yegneswaran et al., “Global Intrusion Detection in the DOMINO Overlay System”, Proceedings of Network and Distributed Security Symposium (NDSS), 17 pages Feb. 2004.Applicant

Vinod Yegneswaran et al., “On the Design and Use of Internet Sinks for Network Abuse Monitoring”, RAID 2004, LNCS 3224, pp. 146-165 (2004).Applicant

Cliff Changchun Zou et al., “Worm Propagation Modeling and Analysis Under Dynamic Quarantine Defense”, WORM'03, Oct. 27, 2003, Washington, DC USA, 10 pages.Applicant

Cliff C. Zou et al., “Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information”, Technical Report: TR-03-CSE-06, Principles of Advanced and Distributed Simulation (PADS) 2005, pp. 199-206, Jun. 1-3, 2005.Applicant

Thorsten Holz, “Anti-Honeypot Technology”, 21st Chaos Communication Congress, slides 1-57, Dec. 2004.Applicant

“CipherTrust's Zombie Stats”, http://www.ciphertrust.com/resources/statistics/zombie.php 3 pages, printed Mar. 25, 2009.Applicant

Joe Thorsten, “Phatbot Trojan Analysis”http://www.secureworks.com/research/threats/phatbot, Mar. 15, 2004, 3 pages.Applicant

Thorsten Holz et al., “A Short Visit to the Bot Zoo”, IEEE Security & Privacy, pp. 7679 (2005).Applicant

Michael Glenn, “A Summary of DoS/DDoS Prevention, Monitoring and Mitigation Techniques in a Service Provider Environment”, SANS Institute 2003, Aug. 21, 2003, pp. ii-iv, and 1-30.Applicant

Dennis Fisher, “Thwarting the Zombies”, Mar. 31, 2003, 2 pages.Applicant

Dongeun Kim et al., “Request Rate Adaptive Dispatching Architecture for Scalable Internet Server”, Proceedings of the IEEE International Conference on Cluster Computing (CLUSTER'00); pp. 289-296 (2000).Applicant

Keisuke Ishibashi et al., “Detecting Mass-Mailing Worm Infected Hosts by Mining DNS Traffic Data”, SIGCOMM'05 Workshops, pp. 159-164 (Aug. 22-26, 2005).Applicant

Nicholas Weaver et al., “A Taxonomy of Computer Worms”, WORM'03, pp. 11-18 (Oct. 27, 2003).Applicant

Stephan Axelsson, “The Base-Rate Fallacy and the Difficulty of Intrusion Detection”, ACM Transactions on Information and System Security, vol. 3, No. 3, pp. 186-205 (Aug. 2000).Applicant

Niel Landwehr et al., “Logistic Model Trees”, Machine Learning, vol. 59, pp. 161-205 (2005).Applicant

Guofei Gu et al. “BotMiner: Clustering Analysis of Network Traffic Protocol- and Structure-Independent Botnet Detection”, 2008, USENIX Security Symposium, pp. 139-154.Applicant

Zhu et al., “Using Failure Information Analysis to Detect Enterprise Zombies,” Lecture note of the Institute for Computer Science, Social-Informatics and Telecommunications Engineering, vol. 19, part 4, pp. 185-206, 2009.Applicant

Manos Antonakakis et al., “Building a Dynamic Reputation System for DNS”, 19th USENIX Security Symposium, Aug. 11-13, 2010 (17 pages).Applicant

Manos Antonakakis et al., “Detecting Malware Domains at the Upper DNS Hierarchy”, In Proceeding of the 20th USENIX Security Symposium, Aug. 8-12, 2011 (16 pages).Applicant

Leyla Bilge et al., “Exposure: Finding Malicious Domains Using Passive DNS Analysis”, 18th Annual Network and Distributed System Security Symposium, Feb. 6-9, 2011 (17 pages).Applicant

“Virus:Win32/Expiro.Z”. http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx, Jun. 9, 2001 (5pages).Applicant

Mike Geide, “Another Trojan Bamital Pattern”, http://research.zscaler.com/2011/05/another-trojan-bamital-pattern.html, May 6, 2011 (5 pages).Applicant

Sergey Golovanov et al., “TDL4—Top Bot”, http://www.secuirlist.com/en/analysis/204792180/TDL4—Top—Bot, Jun. 27, 2011 (15 pages).Applicant

P. Mockapetris, “Domain Names—Concepts and Facilities”, Network Working Group, http://www.ietf.org/rfc/rfc1034.txt, Nov. 1987 (52 pages).Applicant

P. Mockapetris, “Domain Names—Implementation and Specification”, Network Working Group, http://www,ietf.org/rfc/rfc1035.txt, Nov. 1987 (52 pages).Applicant

Phillip Porras et al. “SRI International Technical Report: An Analysis of Conficker's Logic and Rendezvous Points”, http://mtc.sri.com/Conficker/, Mar. 19, 2009, (31 pages).Applicant

Phillip Porras et al. “SRI International Technical Report: Conficker C Analysis”, http://mtc.sri.com/Conficker/addendumC, Apr. 4, 2009, (24 pages).Applicant

Paul Royal, Damballa, “Analysis of the Kracken Botnet”, Apr. 9, 2008 (13 pages).Applicant

Sergei Shevchenko, “Srizbi's Domain Calculator”, http://blog.threatexpert.com/2008/11/srizbix-domain-calculator.html, Nov. 28, 2008 (3 pages).Applicant

Sergei Shevchenko, “Domain Name Generator for Murofet”, http://blog.threatexpert.com/2010/10/domain-name-generator-for-murofet.html, Oct. 14, 2010 (4 pages).Applicant

P Akritidis et al., “Efficient Content-Based Detection of Zero-Day Worms”, 2005 IEEE International Conference in communications, vol. 2, pp. 837-843, May 2005.Applicant

M. Patrick Collins et al., “Hit-List Worm Detection and Bot Identification in Large Networks Using Protocol Graphs”, RAID 2007, LNCS 4637, pp. 276-295 (2007).Applicant

Nicholas Weaver et al., “Very Fast Containment of Scanning Worms”, In proceedings of the 13th USENIX Security Symposium, pp. 29-44, Aug. 9-13, 2004.Applicant

David Whyte et al., “DNS-Based Detection of Scanning Worms in an Enterprise Network”, In Proc. of the 12th Annual Network and Distributed System Security Symposium, pp. 181-195, Feb. 3-4, 2005.Applicant

Cristian Abad et al., “Log Correlation for Intrusion Detection: A Proof of Concept”, In Proceedings of the 19th Annual Computer Security Application Conference (ACSAC'03), (11 pages) (2003).Applicant

Lela A. Adamic et al., “Zipf's Law and the Internet”, Glottometrics, vol. 3, pp. 143-150 (2002).Applicant

K.G. Anagnostakis et al., “Detecting Targeted Attacks Using Shadow Honeypots”, In Proceedings of the 14th USENX Secuirty Symposium, pp. 129-144 (2005).Applicant

Paul Baecher et al., “The Nepenthes Platform: An Efficient Approach to Collect Malware”, In Proceedings of Recent Advances in Intrusion Detection (RAID 2006), LNCS 4219, pp. 165-184, Sep. 2006.Applicant

Paul Barford et al., “An Inside Look at Botnets”, Special Workshop on Malware Detection, Advances in Information Security, Spring Verlag, pp. 171-192 (2006).Applicant

James R. Binkley et al., “An Algorithm for Anomaly-Based Botnet Detection”, 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI '06), pp. 43-48, Jul. 7, 2006.Applicant

Steven Cheung et al., “Modeling Multistep Cyber Attacks for Scenario Recognition”, In Proceedings of the Third DARPA Information Survivability Conference and Exposition (DISCEX III), vol. 1, pp. 284-292, Apr. 22-24, 2003.Applicant

Evan Cooke et al., “The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets”, Steps to Reducing Unwanted Traffic on the lnternet Workshop (SRUTI '05), pp. 39-44, Jul. 7, 2005.Applicant

Frederic Cuppens et al., “Alert Correlation in a Cooperative Intrusion Detection Framework”, In Proceedings of IEEE Symposium on Security and Privacy 2002, pp. 202-215 (2002).Applicant

David Dagon et al., “Modeling Botnet Propagation using Time Zones”, The 13th Annual Network and Distributed System Security Symposium 2006, Feb. 2-3, 2006 (18 pages).Applicant

Roger Dingledine et al., “Tor: The Second-Generation Onion Router”, In Proceedings of the 13th Usenix Security Symposium, pp. 303-320 Aug. 9-13, 2004.Applicant

Steven T. Eckman et al., “STATL: An Attack Language for State-Based Intrusion Detection”, Journal of Computer Security, vol. 10, pp. 71-103 (2002).Applicant

Daniel R. Ellis, et al., “A Behavioral Approach to Worm Detection”, WORM'04, Oct. 29, 2004 (11 pages).Applicant

Prahlad Fogla et al., “Polymorphic Blending Attacks”, In Proceedings of 15th USENIX Security Symposium, pp. 241-256, (2006).Applicant

Jan Goebel, “Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation”, Hot Bots'07, Apr. 10, 2007 (14 pages).Applicant

Koral Ilgun et al., “State Trancsition Analysis: A Rule-Based Intrusion Detection Approach”, IEEE Transactions on Software Engineering, vol. 21, No. 3, pp. 181-199, Mar. 1995.Applicant

Xuxian Jiang et al., “Profiling Self-Propagating Worms via Behavioral Footprinting”, WORM'06, Nov. 3, 2006 (7 pages).Applicant

Giovanni Vigna et al., “NetSTAT: A Network-based Intrusion Detection Approach”, In Proceedings of the 14th Annual Computer Security Applications Conference (ACSAC '98), pp. 25-34, Dec. 7-11, 1998.Applicant

Kelly Jackson Higgins, “Shadowserver to Build ‘Sinkhole’ Server to Find Errant Bots: new Initiative Will Emulate IRC, HTTP Botnet Traffic”, http://darkreading.com/taxonomy/index/printarticle/id/211201241. Sep. 24, 2008 (2 pages).Applicant

Kelly Jackson Higgins, “Hacking a New DNS Attack: DNS Expert Disputes Georgia Tach and Google Research That Points to Malicious Deployment of Certain Types of DNS Servers”, http://darkreading.com/taxonomy/index/printarticie/id/208803784. Dec. 18, 2007 (2 pages).Applicant

Christian Kreibich, “Honeycomb: Automated Signature Creation Using Honeypots”, http://www.icir.ong/christain/honeycomb/index.html, Mar. 26, 2007, (3 pages).Applicant

Artem Dinaburg et al., “Ether: Malware Analysis via Hardware Virtualization Extensions”. CCS'08, Oct. 27-31. 2008 (12 pages).Applicant

Paul Royal, “Alternative Medicine: The Malware Analyst's Blue Pill”, Black Hat USA 2008, Aug. 6, 2008 (33 pages).Applicant

Paul Royal, “Alternative Medicine: The Maiware Analyst's Blue Pill”, www.damballa.com/downloads/r—pubs/KrakenWhitepaper.pdf (2008) (3pages).Applicant

Robert Perdisci et al., “Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces”, USENIX Symposium on Networked Systems Design and Implementation (NSDI 2010), (2010) (16 Pages).Applicant

Christopher Kruegel et al., “Polymorphic Worm Detection using Structural Information of Executables”, RAID 2005, pp. 207-226 (2005).Applicant

Paul Vixie, “DNS Complexity”, ACM Queue, pp. 24-29, Apr. 2007.Applicant

Ke Wang et al., “Anagram: A Content Anomaly Detector Resistant to Mimicry Attack”, In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID) (2006) (20 pages).Applicant

Ke Wang et al., “Anomalous Payload-Based Worm Detection and Signature Generation”, In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID) (2005) (20 pages).Applicant

David Whyte, “Exposure Maps: Removing Reliance on Attribution During Scan Detection”, 1st USENIX Workshop on Hot Topics in Security, pp. 51-55 (2006).Applicant

Jiahai Yang et al., “CARDS: A Distributed System for Detecting Coordinated Attacks”, In Sec (2000) (10 pages).Applicant

Vinod Yegneswaran et al., “Using Honeynets for Internet Situational Awareness”, In proceedings of the Fourth Workshop on Hot Topics in Networks (HotNets IV), Nov. 2005 (6 pages).Applicant

David Dagon et al., “Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority”, In Proceedings of Network and Distributed Security Symposium (NDSS '08) (2008) (15 pages).Applicant

Dihe's IP-Index Browser, http://ipindex.homelinux.net/index.php, updated Oct. 2012 (1 page).Applicant

Shuang Hao et al., “An Internet-Wide View into DNS Lookup Patterns”, http://labs.verisign.com/projects/malicious-domain-names/white-paper/dns-imc2010.pdf (2010) (6 pages).Applicant

Thorsten Holz et al., “Measuring and Detecting Fast-Flux Service Networks”, In Proceedings of NDSS (2008) (12 pages).Applicant

Jaeyeon Jung et al., “DNS Performance and the Effectiveness of Caching”, IEEE/ACM Transactions On Networking, vol. 10, No. 5, pp. 589-603, Oct. 2002.Applicant

The Honeynet Project & Research Alliance, “Know Your Enemy: Fast-Flux Service Networks: An Ever Changing Enemy”, http://old.honeynet.org/papers/ff/fast-flux.html, Jul. 13, 2007 (10 pages).Applicant

Wessels et al., “Measurements and Laboratory Simulations of the Upper DNS Hierarchy”, In PAM (2005) (10 pages).Applicant

Joe Stewart, “Top Spam Botnets Exposed”, http://www.secureworks.com/cyber-threat-intelligence/threats/topbotnets/, Apr. 8, 2008 (11 pages).Applicant

Brett Stone-Gross et al., “Your Botnet is My Botnet: Analysis of a Botnet Takeover”, CCS'09, Nov. 9-13, 2009 (13 pages).Applicant

Sam Stover et al., “Analysis of the Storm and Nugache Trojans: P2P is here”, Login, vol. 32, No. 6, pp. 18-27, Dec. 2007.Applicant

“Storm Botnet”, http://en.wikipedia.org/wiki/Storm—botnet, Printed Jan. 29, 2013 (7 pages).Applicant

Jeff Williams, “What We Know (and Learn) for the Waldeac Takedown”, http://blogs.technet.com/b/mmpc/archive/2010/03/15/what-we-know-and-learned-from-the-waledac-takedown.aspx, Mar. 15, 2010 (2 pages).Applicant

“Trojan:Java/Boonan”, http://microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AJava%2FBoonan, Apr. 17, 2011 (5 pages).Applicant

Julia Wolf, “Technical Details of Srizbi's Domain Algorithm”, http://blog.fireeye.com/research/2008/11/technical-details-of-srizbis-domain-generation-algorithm.html, Nov. 25, 2008 (4 pages).Applicant

Sandeep Yadav et al., “Detecting Algorithmically Generated Malicious Domain Names”, In Proceedings of the 10th Annual Conference on Internet Measurement (IMC'10), pp. 48-61, Nov. 1-3, 2010.Applicant

“TEMU: The BitBlaze Dynamic Analysis Component”, http://bitblaze.cs.berkeley.edu/temu.html, printed Jan. 29, 2013 (1 page).Applicant

Paul Bacher et al., “Know Your Enemy: Tracking Botnets: Using Honeynets to Learn More About Bots”, http://www.honeynet.org/papers/bots, Aug. 10, 2008 (1 page).Applicant

Michael Bailey et al., “Automated Classification and Analysis of Internet Malware”, RAID 2007, LNCS 4637, pp. 178-197 (2007).Applicant

Paul Barham et al., “Xen and the Art of Virtualization”, SOSP'03, Oct. 9-22, 2003 (14 pages).Applicant

Ulrich Bayer et al., “TTAnalyze: A Tool for Analyzing Maiware”, In Proceedings of the 15th Annual Conference European Institute for Computer Antivirus Research (EICAR), pp. 180-192 (2006).Applicant

Fabrice Bellard, “QEMU, A Fast and Portable Dynamic Translator”, In Proceedings of the Annual Confernce on Usenix Annual Technical Conference, pp. 41-46 (2005).Applicant

Kevin Borders et al., “Siren: Catching Evasive Malware (Short Paper)”, IEEE Symposium on Security and Privacy, pp. 78-85, May 21-24, 2006.Applicant

Christopher M. Bishop, Pattern Recognition and Machine Learning (Information Science and Statistics), Springer-Verlag New York, Inc., Secauscus, NJ, USA, 2006.Applicant

Ronen Feldman et al., “The Text Mining Handbook: Advance Approaches in Analyzing Unstructured Data”, Cambridge Univ. Pr., 2007.Applicant

Michael Hale Ligh et al., “Malware Analyst's Cookbook and DVD”, Wiley, 2010.Applicant

M. Newman, “Networks: An Introduction”, Oxford University Press, 2010.Applicant

Matt Bishop, “Computer Security: Art and Science”, Addison-Wesley Professional, 2003.Applicant

Neils Provos et al., “Virtual Honeypots: Form Botnet Tracking to Intrusion Detection”, Addison-Wesley Professional, Reading, 2007.Applicant

Michael Sipser, “Introduction to the Theory of Computation”, International Thomson Publishing, 1996.Applicant

Peter Szor, “The Art of Computer Virus Research and Defense”, Addison-Wesley Professional, 2005.Applicant

Anil K. Jain et al., “Algorithms for Clustering Data”, Prentice-Hall, Inc., 1988.Applicant

V. Laurikari, “TRE”, 2006 (5 pages).Applicant

P. Porras, “Inside Risks: Reflections on Conficker”, Communications of the ACM, vol. 52. 10, pp. 23-24, Oct. 2009.Applicant

Changda Wang et al., “The Dilemma of Covert Channels Searching”, ICISC 2005, LNCS 3935, pp. 169-174, 2006.Applicant

C. Willems et al., “Toward Automated Dynamic Malware Analysis Using CWSandbox”, IEEE Security and Privacy, vol. 5, No. 2, pp. 32-39, 2007.Applicant

R Developmental Core Team, “R: A Language and Environment for statistical Computing”, R. Foundation for Statistical Computing, Vienna Austria, 2008.Applicant

Simon Urbanek, “rJava: Low-Level-R to Java Interface”, printed May 6, 2013 (5 pages).Applicant

Juan Caballero et al., “Polyglot: Automatic Extraction of Protocol Message Format Using Dynamic Binary Analysis”, In Proceedings of ACM Conference on Computer and Communication Security, Oct. 2007 (15 pages).Applicant

Mihai Christodorescu et al., “Semantics-Aware Malware Detection”, In Proceeding of the 2005 IEEE Symposium on Security and Privacy pp. 32-46 (2005).Applicant

Mihai Christodorescu et al., “Mining Specifications on Malicious Behavior”, ESEC/FSE'07, Sep. 3-7,2007 (10 pages).Applicant

Peter Ferrie, “Attacks on Virtual Machine Emulators”, Symantec Advance Threat Research, 2006 (13 pages).Applicant

Peter Ferrie, “Attacks on More Virtual Machine Emulators”, Symantec Advance Threat Research, http://pferrie.tripod.com/papers/attacks2.pdf, 2007 (17 pages).Applicant

Tal Garfinkel et al., “A Virtual Machine Introspection Based Architecture for Intrusion Detection”, In Proceedings of Network and Distributed Systems Security Symposium, Feb. 2003 (16 pages).Applicant

G. Hunt et al., “Detours: Binary Interception of WIN32 Functions”, Proceedings of the 3rd USENIX Windows NT Symposium, Jul. 12-13, 1999 (9 pages).Applicant

Xuxian Jiang et al., “Stealthy Malware Detection Through VMM-Based “Out-of-the-Box” Semantic View Reconstruction”, CCS'07, Oct. 29-Nov. 2, 2007 (11 pages).Applicant

Xuxian Jiang et al., “Virtual Playgrounds for Worm Behavior Investigation”, RAID 2005. LNCS 3858, pp. 1-21 (2006).Applicant

Min Gyung Kang et al., “Renovo: A Hidden Code Extract for Packed Executables”, WORM'07, Nov. 2, 2007 (8 pages).Applicant

Christopher Kruegel et al., “Detecting Kernel-Level Rootkits Through Binary Analysis”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 91-100, Dec. 2004.Applicant

Lorenzo Martignoni et al., “OmniUnpack: Fast, Generic, and Safe Unpacking of Malware”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 431-441 (2007).Applicant

Thomas Raffetseder et al., “Detecting System Emulators”, In ISC, pp. 1-18 (2007).Applicant

Paul Royal et al., “PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware”, In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 289-300 (2006).Applicant

Rich Uhlig et al., “Intel Virualization Technology”, Computer, vol. 38, No. 5, pp. 48-56, May 2005.Applicant

Amit Vasudevan et al., “Stealth Breakpoints”, In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC), pp. 331-392, (2005).Applicant

Amit Vasudevan et al., “Cobra: Fine-Grained Malware Analysis Using Stealth Localized-Executions”, In Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), pp. 264-279 (2006).Applicant

Yi-Min Wang et al., “Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities”, In NDSS'06,(2006) (15 pages).Applicant

Heng Yin et al., “Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis”, In Proceedings of ACM Conference on Computer and Communication Security, Oct. 29-Nov. 2, 2007 (13 pages).Applicant

Joanna Rutkowska, “Introducing Blue Pill”, http://theinvisbilethings.blogspot.com/2006/06/introducing-blue-pill.html, Jun. 22, 2006.Applicant

Peter Ferrie, “Anti-Unpacker Tricks”, In Proceedings of the 2nd International CARO Workshop (2008) (25 pages).Applicant

Danny Quist, “Covert Debugging Circumventing Software Armoring Techniques”; In Proceedings of Black Hat USA 2007 (26 pages).Applicant

Ulrich Bayer at al , “Scalable, Behavior-Based malware Clustering”, In Network and Distributed System Security Symposium (2009) (18 pages).Applicant

David Brumley et al., “Automatically Identifying Trigger-Based Behavior in Malware”, Botnet Detection, pp. 1-24 (2008).Applicant

Dancho Danchev, “Web Based Botnet Command and Control Kit 2.0”, http://ddanchev.blogspot.com/2008/08/web-based-botnet-command-and-control.html, Aug. 22, 2008 (5 pages).Applicant

Ozgun Erdogan et al., “Hash-AV: Fast Virus Signature matching by Cache-Resident Filters”, Int. J. Secur. Netw., vol. 2, pp. 50-59 (2007).Applicant

Fanglu Guo et al., “A Study of the Packer Problem and Its Solutions”, In Recent Advances in Intrusion Detection (RAID 2008), LNCS 5230, pp. 95-115 (2008).Applicant

Maria Halkidi et al., “On Clustering Validation Techniques”, Journal of Intelligent Information Systems, vol. 17, pp. 107-145 (2001).Applicant

A.K. Jain et al., “Data Clustering: A Review”, ACM Computing Surveys, vol. 31, No. 3, pp. 264-323, Sep. 1999.Applicant

John P. John et al., “Studying Spamming Botnets using Botlab”, In Usenix Symposium on Networked Systems Design and Implementation (NDSI), (2009) (16 pages).Applicant

Hyang-Ah Kim et al., “Autograph: Toward Automated, distributed Worm Signature Detection”, In USENIX Security Symposium (2004) (16 pages).Applicant

Clemens Kolbitsch et al., “Effective and Efficient Malware Detection at the End Host”, In 18th USENIX Security Symposium, pp. 351-366 (2009).Applicant

Kevin Borders et al., “Protecting Confidential Data on Personal Computers with Storage Capsules”, In 18th Usenix Security Symposium , pp. 367-382 (2009).Applicant

Ralf Hund et al., “Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms”, In 18th Usenix Security Symlposium, pp. 383-398 (2009).Applicant

Christian Kreibich et al., “Honeycomb—Creating Intrusion Detection Signatures Using Honeypots”, In ACM Workshop on Hot Topics in Networks (2003) (6 pages).Applicant

Zhichun Li et al., “Hamsa: Fast Signature Generated for Zero-Day Polymorphic Worms Provable Attack Resilience”, In IEEE Symposium on Security and Privacy (2006) (15 pages).Applicant

James Newsome et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In IEEE Symposium on Security and Privacy (2005) (16 pages).Applicant

Sun Wu et al., “AGREP—A Fast Approximate Pattern-Matching Tool”, In Usenix Technical Conference (1992) (10 pages).Applicant

Vinod Yegneswaren et al.,, “An Architecture for Generating Semantics-Aware Signatures”, In Usenix Security Symposium (2005) (16 pages).Applicant

Jaeyeon Jung, “Fast Portscan Detection Using Sequential Hypothesis Testing”, In Proceedings of IEEE Symposium on Security Privacy, pp. 211-225 (2004).Applicant

Anestis Karasaridis et al., “Wide-Scale Botnet Detection and Characterization”, In Usenix Workshop on Hot Topics in Understanding Botnets (HotBots'07 ), Apr. 11-13, 2007 (9 pages).Applicant

Carl Livades et al., “Using Machine Learning Techniques to identify Botnet Traffic”, In 2nd IEEE LCN Workshop on Network Security (WoNS'2006), pp. 967-974 (2006).Applicant

“CVE-2006-3439”, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3439, printed Jun. 27, 2012 (2 pages).Applicant

David Moore, “Inferring Internet Denial-of-Service Activity”, In Proceedings of the 10th Usenix Security Symposium, Aug. 13-17, 2001 (15 pages).Applicant

Peng Ning et al., “Constructing Attack Scenarios Through Correlation of Intrusion Alerts”, In Proceedings of Computer and Communications Security (CCS'02), Nov. 18-22, 2002 (10 pages).Applicant

Vern Paxson, “Bro: A System for Detecting Network Intruders in Real-Time”, In Proceedings of the 7th Usenix Security Symposium, Jan. 26-29, 1998 (22 pages).Applicant

Roberto Perdisci et al., “Using an Ensemble of One-Class SVM Classifiers to Harden Payload-Based Anomaly Detection Systems”, In Proceedings of the 6th International Conference on Data Mining (ICDM'06), pp. 488-498, Dec. 2006.Applicant

Phillip A. Porras, “Privacy-Enabled Global Threat Monitoring”, IEEE Security & Privacy, pp. 60-63 (2006).Applicant

Moheeb Abu Rajab et al., “A Multifaceted Approach to Understanding the Botnet Phenomenon”, In Proceedings of the ACM SIGCOMM/USENIX Internet Measurement Conference (ICM`06), Oct. 25-27, 2006 (12 pages).Applicant

Anirudh Ramachandran et al., “Understanding the Network-Level Behavior of Spammers”, In Proceedings of the 2006 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM'06), Sep. 11-16, 2006 (13 pages).Applicant

Martin Roesch, “SNORT—Lightweight Intrusion Detection for Networks”, In Proceedings of 13th System Administration Conference (LISA'99), pp. 229-238, Nov. 7-12, 1999.Applicant

Robin Sommer et al., “Enhancing Byte-Level Network Intrusion Detection Signatures with Context”, In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS'03), pp. 262-271, Oct. 27-30, 2003.Applicant

“W32/IRCBot-TO”, http://www.sophos.com/virusinfo/analyses.w32ircbotto.html, Jan. 19, 2007 (1 page).Applicant

Stuart Staniford et al., “Practical Automated Detection of Stealthy Portscans”, Journal of Computer Security, vol. 10, pp. 105-136 (2002).Applicant

S. Staniford-Chen et al., “GrIDS—A Graph Based Intrusion Detection System for Large Networks”, In Proceedings of the 19th National Information Systems Security Conference, pp. 361-370 (1996).Applicant

Steven J. Templeton et al., “A Requires/Provides Model for Computer Attacks”, In Proceedings of the 2000 Workshop on New Security Paradigms (NSPW'00), pp. 31-38 (2000).Applicant

Alfonso Valdes et al., “Probabilistic Alert Correlation”, In Proceedings of the Recent Attack in Intrusion Detection (RAID 2001), LNCS 2212, pp. 54-68 (2001).Applicant

Fredrik Valeur et al., “A Comprehensive Approach to Intrusion on Detection Alert Correlation”, IEEE Transactions on Dependable and Secure Computing, vol. 1, No. 3, pp. 146-169, Jul. 2004.Applicant

Kjersti Aas et al., “Text Categorisation: A Survey”, Norwegian Computing Center, Jun. 1999 (38 pages).Applicant

M. Andrews, “Negative Caching of DNS Queries (DNS NCACHE)”, http://tools.ietf.org/html/rfc2308, Mar. 1998 (20 pages).Applicant

Simon Biles, “Detecting the Unknown with Snort and Statistical Packet Anomaly Detecting Engine”, www.cs.luc.edu/˜pld/courses/447/sum08/class6/biles.spade.pdf (2003) (9 pages).Applicant

James Newsome et al., “Paragraph: Thwarting Signature Learning by Training Maliciously”, In Recent Advance in Intrusion Detection (RAID), 2005 (21 pages).Applicant

Jon Oberheide et al., “CloudAV: N-Version Antivirus in the Network Cloud”, In Proceedings of the 17th USENIX Security Symposium, pp. 91-106 (2008).Applicant

Dan Pelleg et al., “X-Means: Extending K-Means with Efficient Estimation of the Number of Clusters”, In International Conference on Machine Learning (2000) (8 pages).Applicant

Roberto Perdisci et al., “Misleading Worm Signature Generators Using Deliberate Noise Injection”, In IEEE Symposium on Security and Privacy (2006) (15 pages).Applicant

Mark Felegyhazi et al., “On the Potential of Proactive Domain Blacklisting”, In the Third Usenix LEET Workshop (2010) (8 pages).Applicant

Konrad Rieck et al., “Learning and Classification of Malware Behavior”, DIMVA 2008, LNCS 5137, pp. 108-125 (2008).Applicant

Sumeet Singh et al., “Automated Worm Fingerprinting”, In ACM/USENIX Symposium on Operating System Design and Implementation, Dec. 2004 (16 pages).Applicant

“EFnet Chat Network”, http://www.efnet.org, dated Jun. 18, 2007 (3 pages).Applicant

Guofei Gu et al., “Bothunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation”, Proceedings of 16th USENIX Security Symposium, pp. 167-182 (2007).Applicant

The Conficker Working final Group, “Conficker Working Group: Lessons Learned”, Conficker—Working—Group—Lessons—Learned—17—June—2010—final.pdf, published Jan. 2011 (59 pages).Applicant

Manos Antonakakis et al., “The Command Structure of the Aurora Bonet”, http://www.damballa.com/downloads/r—pubs/Aurora—Botnet—Command—Structure.pdf, 2010 (31 pages).Applicant

R. Arends et al., “Protocol Modifications for the DNS Security Extensions”, htp://www.ietf.org/rfc/rfc4035.txt, Mar. 2005 (50 pages).Applicant

R. Arends et al., “DNS Security Introduction and Requirements”, htp://www.ietf.org/rfc/rfc4033.txt, Mar. 2005 (20 pages).Applicant

R. Arends et al., “Resource Records for the DNS Security Extensions”, htp://www.ietf.org/rfc/rfc4034.txt, Mar. 2005 (28 pages).Applicant

Andreas Berger et al., “Assessing the Real-World Dynamics in DNS”, Lecture Notes in Computer Science, vol. 7189, pp. 1-14 (2012).Applicant

Global Research & Analysis Team (GReAT), “Full Analysis of Flame's Command & Control Servers”, http://www.securelist.com/en/blog/750/Full—Analysis—of—Flames—Command—Control—Servers, Sep. 17, 2012 (10 pages).Applicant

Nicolas Failiere et al., “W32.Stuxnet Dossier”, http://www.symantec.com/content/en/us/enterprise/media/security—response/whitepapers/w32—stuxnet—dossier.pdf, Feb. 2011 (69 pages).Applicant

Steinar H. Gunderson, “Global IPv6 Statistics: Measuring the Current State of IPv6 for Ordinary Users”, http://meetings.ripe.net/ripe-57/presentations/Colitti-Global—IPv6—statistics—-—Measuring—the—current—state—of—IPv6—for—ordinary—users—.7gzD.pdf, Oct. 24-30, 2008 (20 pages).Applicant

Jaeyeon Jung et al., “Modeling TTL-Based Internet Caches”, IEEE INFOCOM 2003, pp. 417-426, Mar. 2003.Applicant

Srinivas Krishnan et al., “DNS Prefetching and Its Privacy Implications: When Good Things Go Bad”, In Proceeding of the 3rd USENIX Conference on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More (LEET'10), (2010) (9 pages).Applicant

Zhuoqing Morley Mao et al., “A Precise and Efficient Evaluation of the Proximity Between Web Clients and Their Local DNS Servers”, In Proceedings of USENIX Annual Technical Conference (2002) (14 pages).Applicant

Mozilla Foundation, “Public Suffix List”, http://publicsuffix.org/, printed May 23, 2013 (8 pages).Applicant

David Plonka et al., “Context-Aware Clustering of DNS Query Traffic”, In Proceedings of the 8th IMC (2008) (13 pages).Applicant

RSA FraudAction Research Labs, “Anatomy of an Attack”, http://blogs/rsa.co,/rivner/anatomy-of-an-attack/, Apr. 1, 2011 (17 pages).Applicant

Steve Souders, “Sharing Dominant Domains”, http://www.stevesouders.com/blog/2009/05/12/sharding-dominant-domains, May 12, 2009 (3 pages).Applicant

Paul Vixie, “What DNS Is Not”, Communications of the ACM, vol. 52, No. 12, pp. 43-47, Dec. 2009.Applicant

N. Weaver et al., “Redirecting DNS for ADS Free and Profit”, In USENIX Workshop on Free and Open communications on the Internet (FOCI), Aug. 2011 (6 pages).Applicant

Florian Weimer, “Passive DNS Replication”, In Proceedings of the 17th Annual FIRST Conference on Computer Security Incident, Apr. 2005 (13 pages).Applicant

Manos Antonakakis et al., “Unveiling the Network Criminal Infrastructure of TDSS/TDL4”, http://www.damballa.com/downloads/r—pubs/Damballa—tdss—tdl4—case—study—public.pdf. (undated) (16 pages).Applicant

Manos Antonakakis et al., “From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware”, In Proceedings of the 21st USENIX Conference on Security Symposium (Security'12), (2012) (16 pages).Applicant

T. Berners-Lee et al., “RFC3986—Uniform Resource Identifier (URI): Generic Syntax”, http://www.hjp.at/doc/rfc/rfc3986.html, Jan. 2005 (62 pages).Applicant

Juan Caballero et al., “Measuring Pay-Per-Install: The Commoditization of malware Distribution”, In Proceedings of the 20th USENIX Conference on Security (SEC'11), (2011) (16 pages).Applicant

Chih-Chung Chang et al., “LIBSVM: A Library for Support Vector Machines” ACM Transactions on Intelligent System and Technology 2011, Last Updated Jun. 14, 2007 (26 pages).Applicant

Dancho Danchev, “Leaked DIY Malware Generating Tool Spotted in the Wild”, http://blog.webroot.com/2013/01/18/leaked-diy-malware-generating-tool-spotted-in-the-wild/, Jan. 18, 2013 (6 pages).Applicant

D. De La Higuera et al., “Topology of Strings: Median String is NP-Complete”, Theoretical Computer Science, vol. 230, pp. 39/48 (2000).Applicant

Robert Edmonds, “ISC Passive DNS Architecture”, http://kb.isc.org/getAttach/30/AA-00654/passive-dns-architecture.pdf, Mar. 2012 (18 pages).Applicant

Manuel Egele et al., “A Survey on Automated Dynamic Malware-Analysis Techniques and Tools”, ACM Computing Surveys, vol. 44, No. 2, Article 6, pp. 6:1-6:42, Feb. 2012.Applicant

Dennis Fisher, “Zeus Source Code Leaked”, http://threatpost.com/en—us/blogs/zeus-source-code-leaked-051011, May 10, 2011 (6 pages).Applicant

Guofei Gu et al., “BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic”, In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), Feb. 2008 (18 pages).Applicant

Grefoire Jacob, “Jackstraws: Picking Command and Control Connections from Bot Traffic”, In Proceedings of the 20th USENIX Conference on Security (SEC'11) (2011) (16 pages).Applicant

Jiyong Jang et al., “Bitshred: Feature Hashing Malware for Scalable Triage and Semantic Analysis”, In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), pp. 309-320, Oct. 17-21, 2011.Applicant

J. Zoo Kolter et al., “Learning to Detect and Classify Malicious Executables in the Wild”, Journal of Machine Learning Research, vol. 7, pp. 2721-2744, Dec. 2006.Applicant

John C. Platt, “Probablistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods”. Advances in Large margin Classifiers, vol. 10, No. 3, pp. 61-74, Mar. 26, 1999.Applicant

Team Cymru, “Developing Botnets”, http://www.team-cymru.com/ReadingRoom/Whitepapers/2010/developing-botnets.pdf (2010) (3 pages).Applicant

Brett Stone-Gross et al., “Pushdo Downloader Variant Generating Fake HTTP Requests”, http://www.secureworks.com/cyber-threat-intelligence/threats/Pushdo—Downloader—Variant—Generating—Fake—HTTP—Requests/, Aug. 31, 2012 (4 pages).Applicant

Peter Wurzinger et al., “Automatically Generting Models of Botnet Detection”, In Proceedings of the 14th European Conference on Research in Computer Security (ESORICS'09), pp. 232-249 (2009).Applicant

Yinglian Xie et al., “Spamming Botnet: Signatures and Characteristics”, In Proceeding of the ACM SIGCOMM 2008 Conference on Data Communications (SIGCOMM'08), pp. 171-182, Aug. 17-22, 2008.Applicant

Yajin Zhou et al., “Dissecting Android Malware: Characterization and Evolution”, 2012 IEEE Symposium On Security and Privacy, pp. 95-109 (2012).Applicant

Nello Cristianini et al., “An Introduction to Support Vector Machines: and other Kernal-Based Learning Methods”, Cambridge University Press, New York, NY, USA (2000).Applicant

Timo Sirainen, “IRSSI”, http://en.wikipedia.org/wiki/Irssi, updated May 8, 2013 (3 pages).Applicant

Team Cymru, “IP to ASN Mapping”, http://www.team-cymru.org/Services/ip-to-asn.html, printed Mar. 23, 2013 (6 pages).Applicant

http://www.bleedingsnort.com, retrieved from Internet Archive on May 23, 2013 Archived Sep. 26, 2006 (3 pages).Applicant

http://www.dshield.org, retrieved from Internet Archive on May 23, 2013 Archived Sep. 29, 2005 (2 pages).Applicant

http://www.alexa.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 25, 2006 (3 pages).Applicant

http://sie.isc.org/, retrieved from Internet Archive on May 23, 2013, Archived Dec. 29, 2008 (2 pages).Applicant

http://damballa.com, retrieved from Internet Archive on May 23, 2013, Archived Jan. 28, 2007 (10 pages).Applicant

http://wwe.dnswl.org, retrieved from Internet Archive on May 23, 2013, Archived Jul. 15, 2006 (4 pages).Applicant

http://www.spamhaus.org/sb1/, retrieved from Internet Archive on May 23, 2013, Archived Sep. 24, 2006 (24 pages).Applicant

http://malwaredomains.com, retrieved from Internet Archive on May 23, 2013, Archived Dec. 28, 2007 (12 pages).Applicant

http://www.opendns.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 9, 2006 (25 pages).Applicant

https://zeustracker.abuse.ch, retrieved from Internet Archive on May 23, 2013, Archived Oct. 26, 2010 (37 pages).Applicant

http://www.threatfire.com, retrieved from Internet Archive on May 23, 2013, Archived Aug. 22, 2007 (18 pages).Applicant

http://www.avira.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 29, 2006 (13 pages).Applicant

https://alliance.mwcollect.org, retrieved from Internet Archive on May 23, 2013, iArchived Jan. 7, 2007 (2 pages).Applicant

http://malfease.oarci.net, retrieved from Internet Archive on May 23, 2013, Archived Apr. 12, 2008 (1 pages).Applicant

http://www.oreans.com/themida.php, retrieved from Internet Archive on May 23, 2013, Archived Aug. 23, 2006 (12 pages).Applicant

http://www.vmware.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 26, 2006 (32 pages).Applicant

Thomas Ptacek, “Side-Channel Detection Attacks Against Unauthorized Hypervisors”, http://www.matasano.com/log/930/side-channel-detection-attacks-against-unauthorized-hypervisors/, Aug. 20, 2007, retrieved from Internet Archive on May 23, 2013, Archived Aug. 27, 2007 (12 pages).Applicant

http://cyber-ta.org/releases/botHunter/index.html, retrieved from Internet Archive on May 23, 2013, Archived Aug. 30, 2007 (6 pages).Applicant

http://anubis.seclab.tuwien.ac.at, retrieved from Internet Archive on May 23, 2013, Archived Apr. 9, 2008 (2 pages).Applicant

http://www.siliconrealms.com, retrieved from Internet Archive on May 23, 2013, Archived Sep. 4, 2006 (12 pages).Applicant

http://bitblaze.cs.berkeley.edu, retrieved from Internet Archive on May 23, 2013, Archived Jan. 28, 2008 (4 pages).Applicant

http://www.dyninst.org, retrieved from Internet Archive on May 23, 2013, Archived Aug. 20, 2006 (pages).Applicant

http://www.peid.info, retrieved from Internet Archive on May 23, 2013, Archived Dec. 4, 2007 (2 pages).Applicant

Mark Russinovich et al., “RegMon for Windows V7.04”, http://technet.microsoft.com/en-us/sysinternals.bb896652.aspx, Published Nov. 1, 2006 (4 pages).Applicant

“Troj/Agobot-IB”, http://www.sophos.com/virusinfo/analyses/trojagobotib.html, pnnted Jun. 27, 2012 (1 page).Applicant

Mark Russinovich et al., “FileMon for Windows V7.04”, http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx, Nov. 1, 2006 (6 pages).Applicant

F. Heinz et al., “IP Tunneling Through Nameserver”, http://slashdot.org/story/00/09/10/2230242/ip-tunneling-through-nameservers, Sep. 10, 2000 (23 Pages).Applicant

http://www.mcafee.com/us/, printed May 23, 2013 (23 pages).Applicant

“Windows Virtual PC”, http://en.wikipedia.org/wiki/Windows—Virtual—PC, Last Modified May 5, 2013, Printed May 23, 2013 (21 pages).Applicant

Par Fabien Perigaud, “New Pill?”, http://cert.lexsi.com/weblog/index.php/2008/03/21/223-new-pill, Mar. 21, 2008 (3 pages).Applicant

http://handlers.sans.org/jclausing/userdb.txt, printed May 24, 2013 (149 pages).Applicant

Avi Kivity et al., “KVM: The Linux Virtual Machine Monitor”, Proceedings of the Linux Symposium, pp. 225-230, Jun. 27-30, 2007.Applicant

Symantec, “Symantec Global Internet Security Threat Report: Trends for 2008”, vol. XIV, Apr. 2009 (110 pages).Applicant

File History of U.S. Appl. No. 12/538,612.Applicant

File History of U.S. Appl. No. 13/205,928.Applicant

File History of U.S. Appl. No. 11/538,212.Applicant

File History of U.S. Appl. No. 12/985,140.Applicant

File History of U.S. Appl. No. 13/008,257.Applicant

File History of U.S. Appl. No. 13/309,202.Applicant

File History of U.S. Appl. No. 13/749,205.Applicant