Method for detecting domain name generated by e.g. robot network in Internet, involves determining third score based on first and second scores, and providing proposition for placing domain name if third score exceeds given threshold

摘要

The method involves capturing responses of a domain name server to domain name requests obtained from a telecommunications network. A first score is determined based on information e.g. date or time to live, relative to a protocol of a domain name system (SND), contained in the responses. A second score is determined based on lexical and syntactic analyses of a domain name style contained in the responses. A third score is determined based on the first and second scores. A proposition for placing a domain name in a black list, is provided if the third score exceeds a given threshold. Independent claims are also included for the following: (1) a server for detecting a domain name generated by a malicious machine network in a telecommunication network, comprising a response capturing unit (2) a computer program comprising instructions for performing a method for detecting a domain name generated by a malicious machine network in a telecommunications network.