1. A method for trimming a wick to a pre-determined length comprising:
providing a first cutting arm having a base;
providing a second cutting arm pivotally connected to said first cutting arm, wherein said second cutting arm includes a measuring foot having a thickness that is greater than a thickness of said base, wherein said measuring foot thickness determines the length of a wick allowed to remain above a top surface of a candle upon trimming the wick;
placing a wick of a candle between the base and measuring foot;
placing a bottom surface of the measuring foot on the top surface of the candle;
moving said first and second cutting arms to a closed position;
cutting the wick to a height that corresponds to the measuring foot thickness such that the cut wick stands underneath a bottom surface of the base when the bottom surface of the measuring foot is contacting the top surface of the candle; and
receiving at a debris tray any portion cut from the wick, wherein the debris tray comprises said measuring foot, a top rim of measuring foot, and said base.
2. The method of claim 1, further comprising the step providing variable cutting strength that is created by a difference in angle of between about 0.25\xb0 and about 1.25\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
3. A wick trimmer comprising:
a first cutting arm having a base;
a second cutting arm pivotally connected to said first cutting arm, wherein said second cutting arm includes a measuring foot having a thickness that is greater than a thickness of said base, wherein said measuring foot thickness determines the length of a wick allowed to remain above the top surface of a candle upon trimming the wick, and wherein a top surface of said measuring foot includes a cutting edge; and
a debris tray configured to received any portion off the wick, wherein the debris tray comprises said measuring foot, a top rim of said measuring foot, and said base.
4. The wick trimmer of claim 3, wherein said measuring foot thickness is between about \u215b\u2033 and about \u215e\u2033.
5. The wick trimmer of claim 3, wherein said base comprises a cutting edge.
6. The wick trimmer of claim 3, wherein said first and second cutting arms are configured so as to create variable cutting strength along said cutting edge as said first cutting arm and said second cutting arm are directed to a closed position.
7. The wick trimmer of claim 6, wherein said variable cutting strength is created by a difference in angle of between about 0.25\xb0 and about 1.25\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
8. The wick trimmer of claim 6, wherein said variable cutting strength is created by a difference in angle of between about 0.50\xb0 and about 1.00\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
9. The wick trimmer of claim 6, wherein said variable cutting strength is created by a difference in angle of about 0.75\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
10. The wick trimmer of claim 9, wherein said bottom angle of said first cutting arm is about 105.75\xb0 and said bottom angle of said second cutting arm is about 105.00\xb0.
11. The wick trimmer of claim 1, wherein a top angle of said first cutting arm forms an angle of between about 100\xb0 and about 110\xb0.
12. The wick trimmer of claim 1, wherein a top angle of said second cutting arm forms an angle of between about 100\xb0 and about 110\xb0.
13. The wick trimmer of claim 1, wherein the wick trimmer comprises stainless steel.
14. A wick trimmer comprising:
a first cutting arm coupled to a based;
a second cutting arm coupled to a measuring foot having a thickness that is greater than a thickness of said base, wherein said measuring foot thickness determines a length of a wick allowed to remain above a top surface of a candle upon trimming the wick, wherein said second cutting arm is pivotally connected to said first cutting arm;
a debris tray configured to received any portion trimmed off of the wick, wherein the debris tray comprises said measuring foot, a top rim of said measuring foot, and said base; and
a cutting edge formed along said base.
15. The wick trimmer of claim 14, wherein said measuring foot has a thickness of between about \u215b\u2033 and about \xbd\u2033.
16. The wick trimmer of claim 14, wherein said measuring foot has a thickness of about \xbc\u2033.
17. The wick trimmer of claim 14, said first cutting arm having a top angle of between about 95.00\xb0 and about 115.00\xb0 and a bottom angle at least about 0.25\xb0 greater than the top angle.
18. The wick trimmer of claim 14, said second cutting arm having a top angle and a bottom angle of between about 95.00\xb0 and about 115.00\xb0.
19. The wick trimmer of claim 14, wherein the difference between a top angle and a bottom angle of said first cutting arm creates variable cutting strength along said cutting edge as said first cutting arm and said second cutting arm are directed to a closed position.
20. The wick trimmer of claim 14, wherein a middle portion of said first cutting arm is angled between about 170\xb0 and about 175\xb0 and a middle portion of said second cutting arm is angled between about 170\xb0 and about 175\xb0, allowing said first cutting arm and said second cutting arm to overlap so that said first cutting arm and said second cutting arm can pivotally connect.
21. The wick trimmer of claim 14, wherein a bottom angle of said first cutting arm is about 105.75\xb0 and a bottom angle of said second cutting arm is about 105.00\xb0.
22. The wick trimmer of claim 14, wherein a first end of said first cutting arm forms an angle of between about 100\xb0 and about 110\xb0.
23. The wick trimmer of claim 14, wherein a first end of said second cutting arm forms an angle of between about 100\xb0 and about 110\xb0.
24. The wick trimmer of claim 14, wherein said wick trimmer is configured so as to fit into a cover of a candle, wherein the cover is at least about 1.5 inches in diameter.
25. The wick trimmer of claim 14, wherein the cutting edge is configured to cut through a wick, regardless of whether the wick has been burned previous to the cut.
26. A wick trimmer comprising:
a first cutting arm having a base; and
a second cutting arm pivotally coupled to said first cutting arm, wherein said second cutting arm includes a measuring foot having a thickness that is greater than a thickness of said base, wherein said measuring foot thickness determines the length of a wick allowed to remain above a top surface of a candle upon trimming the wick, and wherein said measuring foot and said base each includes a cutting edge, and wherein said first and second cutting arms are configured so as to create variable cutting strength along said cutting edges as said first cutting arm and said second cutting arm are directed to a closed position; and
a debris tray configured to received any portion trimmed off of the wick, wherein the debris tray comprises said measuring foot, a top rim of said measuring foot, and said base.
27. The wick trimmer of claim 26, wherein said variable cutting strength is created by a difference in angle of between about 0.25\xb0 and about 1.25\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
28. The wick trimmer of claim 26, wherein said variable cutting strength is created by a difference in angle of between about 0.35\xb0 and about 1.15\xb0 between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
29. The wick trimmer of claim 26, wherein said variable cutting strength is created by a difference in angle of about 0.75 degrees between a bottom angle of said first cutting arm and a bottom angle of said second cutting arm.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method for detecting Fast-Flux malware, the method comprising:
monitoring by a network traffic monitor a plurality of domain name system (DNS) lookup requests to one or more DNS servers initiated by one or more network devices in a local area network (LAN) to a wide area network (WAN), the DNS lookup requests comprising a plurality of requests to resolve one or more uniform resource locators (URLs) to one or more received network addresses (IP);
monitoring the one or more received network addresses (IP) resolved for the one or more URLs to provide a URL-to-IP associations list, wherein the URL-to-IP associations list is configured to store one or more suspicious URLs;
monitoring the one or more DNS servers used for the DNS lookup requests for resolving the URLs to provide a DNS Domain-to-DNS server associations list;
generating a suspicious URL log based on the URL-to-IP associations list and a suspicious DNS log based on the DNS Domain-to-DNS server associations list;
determining whether a designated suspicious URL from the suspicious URL log matches designated data in the suspicious DNS log; and
after determining that the designated suspicious URL from the suspicious URL log matches the designated data in the suspicious DNS log, generating an event indicating a combination of flux actions are active.
2. The method of claim 1, further comprising indicating a presence of a malware program in the LAN based on the suspicious DNS log and the suspicious URL log.
3. The method of claim 1, further comprising:
configuring a resource association list comprising the URL-to-IP associations list or the DNS Domain-to-DNS server associations list; and
configuring a suspicious resource log comprising the suspicious URL log or the suspicious DNS log.
4. The method of claim 3, further comprising:
counting a total number of association changes in the resource association list; and
logging the suspicious resource log, if the total number of association changes is greater than a total-association-change threshold.
5. The method of claim 3, further comprising:
counting a number of association changes in the resource association list in a time-period; and
logging the suspicious resource log, if the number of association changes in the time-period is greater than a time-period-association-changes threshold.
6. The method of claim 3, further comprising:
calculating an association change frequency of the resource association list; and
logging the suspicious resource log, if the association change frequency is greater than an association-change-frequency threshold.
7. The method of claim 3, further comprising:
calculating a pattern in the resource association list; and
logging the suspicious resource log, if the pattern is found among a pattern history.
8. A system for detecting Fast-Flux malware, the system comprising:
at least one hardware processor; and
a network traffic monitor operating on the at least one hardware processor and configured to:
monitor a plurality of domain name system (DNS) lookup requests to one or more DNS servers initiated by one or more network devices in a local area network (LAN) to a wide area network (WAN), the DNS lookup requests comprising a plurality of requests to resolve one or more uniform resource locators (URLs) to one or more received network addresses (IP);
monitor the one or more received network addresses (IP) resolved for resolving the one or more URLs to provide a URL-to-IP associations list;
monitor the one or more DNS servers used for the DNS lookup requests for resolving the URLs to provide a DNS Domain-to-DNS server associations list; and
a malware detector configured to:
generate a suspicious URL log based on the URL-to-IP associations list and a suspicious DNS log based on the DNS Domain-to-DNS server associations list;
determine whether a designated suspicious URL from the suspicious URL log matches designated data in the suspicious DNS log;
after determining that the designated suspicious URL from the suspicious URL log matches the designated data in the suspicious DNS log, generate an event indicating a combination of flux actions are active; and
indicate a presence of a malware program in the LAN based on the suspicious URL log and the suspicious DNS log.
9. The system of claim 8, wherein:
a resource association list comprises the URL-to-IP associations list or the DNS Domain-to-DNS server associations list; and
a suspicious resource log comprises the suspicious URL log or the suspicious DNS log.
10. The system of claim 9, wherein the malware detector is further configured to:
count a total number of association changes in the resource association list; and
log the suspicious resource log, if the total number of association changes is greater than a total-association-change threshold.
11. The system of claim 9, wherein the malware detector is further configured to:
count a number of association changes in the resource association list in a time-period; and
log the suspicious resource log, if the number of association changes in the time-period is greater than a time-period-association-changes threshold.
12. The system of claim 9, wherein the malware detector is further configured to:
calculate an association change frequency of the resource association list; and
log the suspicious resource log, if the association change frequency is greater than an association-change-frequency threshold.
13. The system of claim 9, wherein the malware detector is further configured to:
calculate a pattern in the resource association list; and
log the suspicious resource log, if the pattern is found among a pattern history.
14. A non-transitory computer readable storage medium comprising computer-executable instructions for detecting Fast-Flux malware, the computer-executable instructions comprising:
monitoring by a network traffic monitor a plurality of domain name system (DNS) lookup requests to one or more DNS servers initiated by one or more network devices in a local area network (LAN) to a wide area network (WAN), the DNS lookup requests comprising a plurality of requests to resolve one or more uniform resource locators (URLs) to one or more received network addresses (IP);
monitoring the one or more received network addresses (IP) resolved for resolving the one or more URLs to provide a URL-to-IP associations list;
monitoring the one or more DNS servers used for the DNS lookup requests for resolving the URLs to provide a DNS Domain-to-DNS server associations list;
generate a suspicious URL log based on the URL-to-IP associations list and a suspicious DNS log based on the DNS Domain-to-DNS server associations list;
determining whether a designated suspicious URL from the URL-to-IP associations list matches designated data in the DNS Domain-to-DNS server associations list; and
after determining that the designated suspicious URL from the URL-to-IP associations list matches the designated data in the DNS Domain-to-DNS server associations list, generating an event indicating a combination of flux actions are active.
15. The non-transitory computer readable storage medium of claim 14, further comprising computer-executable instructions comprising: indicating a presence of a malware program in the LAN based on the suspicious DNS log or the suspicious URL log.
16. The non-transitory computer readable storage medium of claim 14, further comprising computer-executable instructions comprising:
configuring a resource association list comprising the URL-to-IP associations list or the DNS Domain-to-DNS server associations list; and
configuring a suspicious resource log comprising the suspicious URL log or the suspicious DNS log.
17. The non-transitory computer readable storage medium of claim 16, further comprising computer-executable instructions comprising:
counting a total number of association changes in the resource association list; and
logging the suspicious resource log, if the total number of association changes is greater than a total-association-change threshold.
18. The non-transitory computer readable storage medium of claim 16, further comprising computer-executable instructions comprising:
counting a number of association changes in the resource association list in a time-period; and
logging the suspicious resource log, if the number of association changes in the time-period is greater than a time-period-association-changes threshold.
19. The non-transitory computer readable storage medium of claim 16, further comprising computer-executable instructions comprising:
calculating an association change frequency of the resource association list; and
logging the suspicious resource log, if the association change frequency is greater than an association-change-frequency threshold.
20. The non-transitory computer readable storage medium of claim 16, further comprising computer-executable instructions comprising:
calculating a pattern in the resource association list; and
logging the suspicious resource log, if the pattern is found among a pattern history.