Granted Patent B2

US 12,417,282 · App. 17/528,633 · Granted Sep 16, 2025

Inventors: Dmitry Aleksandrovich Volkov (Moscow, RU); Philipp Alekseevich Mileshin (Moscow, RU)

Assignee: F.A.C.C.T. NETWORK SECURITY LLC

G06F21/564G06F21/552G06F21/577H04L63/1491

Abstract

Claims (41)

1. A computer-implementable method for detecting elements of a malicious infrastructure in an infrastructure element database, the method being executable by at least one processor, the method comprising:

receiving a request comprising an infrastructure element of the malicious infrastructure,

the malicious infrastructure being associated with a tag, the tag being indicative of at least one of a cybercriminal and a piece of malware known to be associated with the malicious infrastructure;

the infrastructure element having a parameter,

the infrastructure element comprising at least one selected from the group consisting of: an Internet Protocol (IP) address; a domain name; a Secure Sockets Layer (SSL) certificate; a server; a web service; an e-mail address; and a telephone number; and

the parameter including at least one selected from the group consisting of: an other associated IP address, an SSL key, a Secure Shell (SSH) footprint, a list of running services, a history of running services, a history of domain names, a history of IP addresses, a history of Domain Name System (DNS) servers, a history of domain name or IP address owners, a hosting provider, and a geographic location;

searching the infrastructure element database to identify therein, based at least on the tag associated with the infrastructure element, (i) an additional infrastructure element; (ii) and an additional parameter of the additional infrastructure element,

the additional infrastructure element having been assigned with the tag, indicative of the additional infrastructure element being known to be associated with the malicious infrastructure;

executing a machine-learning algorithm (MLA) to analyze (i) the infrastructure element and the parameter thereof, and (ii) the additional infrastructure element and the additional parameter thereof to determine whether the respective parameter of the infrastructure element and the additional parameter of the additional infrastructure element are both linked to at least one other parameter of a new infrastructure element, which is unidentified and unknown to be associated with any malicious infrastructure,

the MLA having been trained to determine, based on previously determined relations of given-type parameters of a training infrastructure element with other parameters, whether the given-type parameters of the infrastructure element are linked to the other parameters according to the previously determined relations associated with the training infrastructure element;

in response to determining that the respective parameter of the infrastructure element is linked to the at least one other parameter akin to the additional parameter of the additional infrastructure element being linked to the at least one other parameter, generating rules for identifying, in the infrastructure element database, new infrastructure elements, which were previously unidentified and unknown to be associated with any malicious infrastructure,

a given rule of the rules including a regular expression that is representative of how the respective parameter and the additional respective parameter are linked to a given one of the at least one other parameter;

retrieving, using the rules, from the infrastructure element database, the new infrastructure elements; and

determining the new infrastructure elements as being associated with the malicious infrastructure by assigning the tag to the new infrastructure elements, thereby updating the infrastructure element database for further use in determining other new infrastructure elements of the malicious infrastructure.

2. The method of claim 1 , wherein the infrastructure element database is continuously updated using data obtained by scanning the Internet.

3. The method of claim 2 , wherein the scanning the Internet is performed by at least one vulnerability scanner.

4. The method of claim 1 , wherein the tag is one of a conventional name and a common name of the at least one selected from the group consisting of the piece malware and the cybercriminal associated with the malicious infrastructure.

5. The method of claim 1 , wherein the request comprising the at least one infrastructure element is received from at least one of:

a sandbox;

a malware detonation platform;

a vulnerability scanner;

a honeypot;

an intrusion detection system; and

a system of emergency response to cyber security incidents.

6. The method of claim 1 , wherein the determining whether the parameter and the additional parameter are both linked to the at least one other parameter comprises determining a combination thereof by at least one logic operation, and wherein each of the infrastructure element and the additional infrastructure elements respectively associated therewith are different infrastructure elements.

7. The method of claim 1 , wherein the rules are stored and updated.

8. A system for detecting elements of a malicious infrastructure in an infrastructure element database, the system comprising:

at least one processor communicatively coupled to the infrastructure element database;

at least one non-transitory computer-readable memory storing executable instructions, which, when executed by the at least one processor, cause the system to:

receive a request comprising an infrastructure element of the malicious infrastructure,

the malicious infrastructure being associated with a tag, the tag being indicative of at least one of a cybercriminal and a piece of malware known to be associated with the malicious infrastructure; the infrastructure element having a parameter,

the infrastructure element comprising at least one selected from the group consisting of: an Internet Protocol (IP) address; a domain name; a Secure Sockets Layer (SSL) certificate; a server; a web service; an e-mail address; and a telephone number; and

the parameter including at least one selected from the group consisting of: an other associated IP address, an SSL key, a Secure Shell (SSH) footprint, a list of running services, a history of running services, a history of domain names, a history of IP addresses, a history of Domain Name System (DNS) servers, a history of domain name or IP address owners, a hosting provider, and a geographic location;

search the infrastructure element database to identify therein, based at least on the tag associated with the infrastructure element, (i) an additional infrastructure element; (ii) and an additional parameter of the additional infrastructure element,

the additional infrastructure element having been assigned with the tag, indicative of the additional infrastructure element being known to be associated with the malicious infrastructure;

execute a machine-learning algorithm (MLA) to analyze (i) the infrastructure element and the parameter thereof, and (ii) the additional infrastructure element and the additional parameter thereof to determine whether the parameter of the infrastructure element and the additional parameter of the additional infrastructure element are both linked to at least one other parameter of a new infrastructure element, which is unidentified and unknown to be associated with any malicious infrastructure,

the MLA having been trained to determine, based on previously determined relations of given-type parameters of a training infrastructure element with other parameters, whether the given-type parameters of the infrastructure element are linked to the other parameters according to the previously determined relations associated with the training infrastructure element;

in response to determining that the respective parameter of the infrastructure element is linked to the at least one other parameter akin to the additional parameter of the additional infrastructure element being linked to the at least one other parameter, generate rules for identifying, in the infrastructure element database, new infrastructure elements, which were previously unidentified and unknown to be associated with any malicious infrastructure,

a given rule of the rules including a regular expression that is representative of how the respective parameter and the additional respective parameter are linked to a given one of the at least one other parameter;

retrieve, using the rules, from the infrastructure element database, the new infrastructure elements; and

determine the new infrastructure elements as being associated with the malicious infrastructure by assigning the tag to the new infrastructure elements, thereby updating the infrastructure element database for further use in determining other new infrastructure elements of the malicious infrastructure.

Assignments (3)

Priority Claims (1)

Continuity (2)

References Cited (331)