公开(公告)号：US20210120022A1

公开(公告)日：2021-04-22

申请号：US16659027

申请日：2019-10-21

Applicant: Avast Software s.r.o.

Inventor： Petr Kaderábek ,  Vladislav Iliushin

IPC: H04L29/06

Abstract: Data relating to attacks is collected in honeypots, including network address of attacks and time of attacks. The attack data is analyzed to generate a predicted likelihood of future attacks from network addresses in the activity data, and a network address blacklist is constructed including network addresses predicted likely to be a source of a future attack. The process is repeated over time, such that network addresses with no recent honeypot activity are removed from the blacklist.

公开(公告)号：US11586881B2

公开(公告)日：2023-02-21

申请号：US16799738

申请日：2020-02-24

Applicant: Avast Software s.r.o.

Inventor： Petr Gronát ,  Petr Kaderábek ,  Jakub Sanojca

IPC: H04L9/40 ,  G06N3/049 ,  G06N3/08 ,  G06K9/62

Abstract: A method of generating receiving a valid domain name comprises evaluating a received valid domain name in a neural network trained to generate similar domain names, and providing an output comprising at least one domain name similar to the received valid domain name generated by the neural network. In a further example, a recurrent neural network is trained using valid domain names and observed malicious similar domain names and/or linguistic rules. In another example, the output of the recurrent neural network further comprises a similarity score reflecting a degree of similarity between the valid domain name and the similar domain name, such that the similarity score can be used to generate a ranked list of domain names similar to the valid domain name.

公开(公告)号：US20210264233A1

公开(公告)日：2021-08-26

申请号：US16799738

申请日：2020-02-24

Applicant: Avast Software s.r.o.

Inventor： Petr Gronát ,  Petr Kaderábek ,  Jakub Sanojca

IPC: G06N3/04 ,  G06N3/08 ,  G06K9/62 ,  H04L29/06

Abstract: A method of generating receiving a valid domain name comprises evaluating a received valid domain name in a neural network trained to generate similar domain names, and providing an output comprising at least one domain name similar to the received valid domain name generated by the neural network. In a further example, a recurrent neural network is trained using valid domain names and observed malicious similar domain names and/or linguistic rules. In another example, the output of the recurrent neural network further comprises a similarity score reflecting a degree of similarity between the valid domain name and the similar domain name, such that the similarity score can be used to generate a ranked list of domain names similar to the valid domain name.