Systems and methods for external detection of misconfigured systems

1. A computer-implemented method for external detection of a vulnerable system coupled to a communication network based on domain name properties, the method comprising:

receiving communication traffic data from at least one service provider to identify at least one domain name associated with a vulnerable system, the communication traffic originating from at least one server system in the communication network;

executing queries on the communication traffic to extract metadata while monitoring the communication traffic;

identifying the domain name and an associated property indicative of vulnerability of the domain name based on the metadata, wherein the associated property indicative of vulnerability comprises communication traffic data from a geographical location and that is associated with the identified domain name;

determining whether the domain name is registered at a domain name registry;

if the domain name is not registered, registering the domain name based on a high frequency of domain names from a particular geographical location and having a property indicative of vulnerability in that particular geographical location; and

detecting the vulnerable system associated with the registered domain name.

2. The method of claim 1 , wherein each domain name having the property indicative of vulnerability is selected from the group consisting of: (i) an unregistered domain name, (ii) a misconfigured domain name, (iii) an abandoned domain name, and (iv) an algorithm-generated domain name.

3. The method of claim 1 , wherein the vulnerable system is a malware-infected server system.

4. The method of claim 1 , wherein the vulnerable system is a misconfigured server system.

5. The method of claim 1 , further comprising:

associating the registered domain name with a server system configured to monitor communication traffic to the registered domain name.

6. The method of claim 1 , wherein receiving communication traffic to identify the domain name further comprises:

comparing relative magnitude of communication traffic to an expected amount of traffic.

7. The method of claim 1 , wherein receiving communication traffic to identify the domain name further comprises:

measuring a frequency of communication traffic to the domain name.

8. The method of claim 1 , wherein the metadata further comprises data selected from the group consisting of: (a) frequency of the communication traffic, (b) magnitude of the communication traffic, (c) aggregated counters of a number of unique Internet Protocol (IP) addresses per country, (d) a number of events observed per period, and (e) a ratio of unique IP addresses to a sum of a portion of the communication traffic.

9. A system for external detection of a vulnerable system coupled to a communication network, the system comprising:

at least one computer system programmed to perform operations comprising:

receiving communication traffic data from at least one service provider on the communication network to identify at least one domain name associated with a vulnerable system, the communication traffic originating from at least one server system in the communication network;

executing queries on the communication traffic to extract metadata while monitoring the communication traffic;

identifying the domain name and an associated property indicative of vulnerability of the domain name based on the metadata, wherein the associated property indicative of vulnerability comprises communication traffic data from a geographical location and that is associated with the identified domain name;

determining whether the domain name is registered at a domain name registry;

if the domain name is not registered, registering the domain name based on a high frequency of domain names in a particular geographical location and having a property indicative of vulnerability in that particular geographical location; and

detecting the vulnerable system associated with the registered domain.

10. The system of claim 9 , wherein each domain name having the property indicative of vulnerability is selected from the group consisting of: (i) an unregistered domain name, (ii) a misconfigured domain name, (iii) an abandoned domain name, and (iv) an algorithm-generated domain name.

11. The system of claim 9 , wherein the vulnerable system is a malware-infected server system.

12. The system of claim 9 , wherein the vulnerable system is a misconfigured server system.

13. The system of claim 9 , wherein the operations further comprise:

associating the registered domain name with a server system configured to monitor communication traffic to the registered domain name.

14. The system of claim 9 , wherein receiving communication traffic to identify the domain name further comprises:

receiving communication traffic data from one or more Internet service providers (ISP).

15. The system of claim 9 , wherein receiving communication traffic to identify the domain name further comprises:

comparing relative magnitude of communication traffic to an expected amount of traffic.

16. The system of claim 9 , wherein receiving communication traffic to identify the domain name further comprises:

measuring a frequency of communication traffic to the domain name.

17. The system of claim 9 , wherein the metadata further comprises data selected from the group consisting of: (a) frequency of the communication traffic, (b) magnitude of the communication traffic, (c) aggregated counters of a number of unique Internet Protocol (IP) addresses per country, (d) a number of events observed per period, and (e) a ratio of unique IP addresses to a sum of a portion of the communication traffic.

18. A computer-implemented method for external detection of a vulnerable system coupled to a communication network based on domain name properties, the method comprising:

receiving communication traffic data from at least one service provider to identify at least one domain name associated with a vulnerable system, the communication traffic originating from at least one server system in the communication network;

executing queries on the communication traffic to extract metadata while monitoring the communication traffic;

identifying the domain name and an associated property indicative of vulnerability of the domain name based on the metadata, wherein the identified domain name is a misconfigured domain name and the associated property indicative of vulnerability comprises communication traffic data from a geographical location and that is associated with the identified domain name;

determining whether the domain name is registered at a domain name registry; and

if the domain name is not registered, registering the domain name based on a high frequency of domain names from a particular geographical location and having a property indicative of vulnerability in that particular geographical location.

19. A computer-implemented method for external detection of a vulnerable system coupled to a communication network based on domain name properties, the method comprising:

receiving communication traffic data from at least one service provider to identify at least one domain name associated with a vulnerable system, the communication traffic originating from at least one server system in the communication network;

executing queries on the communication traffic to extract metadata while monitoring the communication traffic;

identifying the domain name and an associated property indicative of vulnerability of the domain name based on the metadata, wherein the identified domain name is an algorithm-generated domain name and the associated property indicative of vulnerability comprises communication traffic data from a geographical location and that is associated with the identified domain name;

determining whether the domain name is registered at a domain name registry; and

if the domain name is not registered, registering the domain name based on a high frequency of domain names from a particular geographical location and having a property indicative of vulnerability in that particular geographical location.