Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services
US10484422B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 18, 2016 |
| Grant date | Nov 19, 2019 |
| Priority date | — |
| Expiry date | Jul 12, 2037 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/144
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.