Abstract: A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Abstract: A system and method for determining whether at least one domain is legitimate or malicious by obtaining passive DNS query information, using the passive DNS query information to measure statistical features of known malicious domain names and known legitimate domain names, and using the statistical features to determine at least one reputation for at least one new domain, where the reputation indicates whether the at least one new domain is likely to be for malicious or legitimate uses.

Abstract: A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Abstract: Collect Domain Name System (DNS) data, the DNS data generated by a DNS server and/or similar device, wherein the DNS data comprises DNS queries, wherein the collected DNS data comprises DNS query rate information. Examine the collected DNS data relative to DNS data from known compromised and/or uncompromised computers. Determine an existence of the collection of compromised networks and/or computers, and/or an identity of compromised networks and/or computers, based on the examination.

Abstract: A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Abstract: A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Abstract: A system and method for determining whether at least one domain is legitimate or malicious by obtaining passive DNS query information, using the passive DNS query information to measure statistical features of known malicious domain names and known legitimate domain names, and using the statistical features to determine at least one reputation for at least one new domain, where the reputation indicates whether the at least one new domain is likely to be for malicious or legitimate uses.

Abstract: A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Abstract: An invention for displaying patterns of utilization of a resource wherein the resource includes a plurality of correlated or uncorrelated objects. The method consists of providing a number of graphical formats from which a format is selected for display of patterns of utilization. Additionally, a query is submitted regarding a particular utilization of the resource. Along with the selected format and query inputs, the invention receives information regarding utilization of the resource from a system. Once the invention receives the inputs and the utilization information from the system, the invention processes the information to a format that conforms with the inputs. The invention then displays the processed information in the selected graphical format. The invention also allows the selection of a second graphical format from the graphical formats for altering the display to show the processed information in the second selected format.

Abstract: An invention for displaying patterns of utilization of a resource wherein the resource includes a plurality of correlated or uncorrelated objects. The method consists of providing a number of graphical formats from which a format is selected for display of patterns of utilization. Additionally, a query is submitted regarding a particular utilization of the resource. Along with the selected format and query inputs, the invention receives information regarding utilization of the resource from a system. Once the invention receives the inputs and the utilization information from the system, the invention processes the information to a format that conforms with the inputs. The invention then displays the processed information in the selected graphical format. The invention also allows the selection of a second graphical format from the graphical formats for altering the display to show the processed information in the second selected format.