US 12,294,593 B1
Systems and methods for detecting malware domain names
Robert Neel, Boerne, TX (US)
Assigned to United Services Automobile Association (USAA), San Antonio, TX (US)
Filed by United Services Automobile Association (USAA), San Antonio, TX (US)
Filed on Jan. 19, 2024, as Appl. No. 18/418,196.
Application 18/418,196 is a continuation of application No. 17/890,201, filed on Aug. 17, 2022, granted, now 11,916,935.
Application 17/890,201 is a continuation of application No. 16/143,053, filed on Sep. 26, 2018, granted, now 11,457,022, issued on Sep. 27, 2022.
Claims priority of provisional application 62/563,530, filed on Sep. 26, 2017.
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); G06F 16/23 (2019.01); G06F 16/245 (2019.01); H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [G06F 16/2379 (2019.01); G06F 16/245 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, by at least one server, a plurality of log files from a plurality of data sources, wherein each of the plurality of log files contains a domain name field;
identifying, by the at least one server, non-identical yet equivalent domain names that each include an identical consecutive character pattern;
in response to identifying at least two non-identical yet equivalent domain names parsed from data fields of the plurality of log files that include the identical consecutive character pattern,
replacing one or more of the at least two non-identical yet equivalent domain names with one or more replacement unique domain names;
identifying, by the at least one server, one or more unique domain names and eliminating one or more duplicative domain names,
wherein the one or more duplicative domain names include at least one of the one or more replacement unique domain names;
determining a credibility score for the one or more unique domain names based on a length of the one or more unique domain names and a comparison of the one or more unique domain names to a domain name corpus stored in a dictionary database; and
updating a blacklist record to include the one or more unique domain names based on the credibility score.