SUSPICIOUS DOMAIN DETECTION FOR THREAT INTELLIGENCE

A computer implemented method detects suspicious domains. A computer system determines a homographic similarity between a target domain and a known domain. The compute system compares first registration information for the target domain and second registration information for the known domain to form a registration comparison in response the homographic similarity being sufficiently similar to be potentially suspicious. The computer system compares a set of first landing page images for the target domain and a set of second landing page images for the known domain to form an image comparison in response to a match between the first ownership information for the target domain and the second ownership information for the known domain being absent. The computer system determines a threat level for the target domain based on the image comparison.

BACKGROUND

The disclosure relates generally to an improved data processing system, and more specifically, to a computer implemented method, apparatus, system, and computer program product for early warning detection of suspicious websites.

2. Description of the Related Art

Cybersecurity involves protecting computer systems and networks from threats such as information disclosure, theft of information, damage to hardware, software, or data. This protection also includes protecting against disruption or misdirection of the services provided by computer systems and networks.

Threat intelligence feeds are an important form of defense to entities such as security operations centers (SOCs) and computer emergency response teams (CERTs). This information can be used to provide additional information about incidents and for formulating actions in response to various threats on the Internet. In obtaining threat intelligence, searches can be performed for suspicious behavior in federated environments.

These threats can include look-alike domains that are used to divert web traffic and distribute malware. For example, a suspicious domain may have a similar homographic spelling that is designed to divert traffic to that domain from a well-known domain. These types of websites diver traffic from well-known domains and can harm brands of companies and phish for customer data.

SUMMARY

According to one illustrative embodiment, a computer implemented method detects suspicious domains. A computer system determines a homographic similarity between a target domain and a known domain. The computer system compares first ownership information for the target domain and second ownership information for the known domain to form an ownership comparison in response the homographic similarity being sufficiently similar to be potentially suspicious. The computer system compares a set of first landing page images for the target domain and a set of second landing page images for the known domain to form an image comparison in response to a match between the first ownership information for the target domain and the second ownership information for the known domain being absent. The computer system determines a threat level for the target domain based on the image comparison. According to other illustrative embodiments, a computer system and a computer program product for detecting suspicious domains are provided.

DETAILED DESCRIPTION

The illustrative embodiments recognize and take into account a number of different considerations as described herein. For example, the illustrative embodiments recognize and take into account that it is desirable to detect suspicious domains before threats originating from those domains are visible or detected. In performing suspicious domain identification, newly observed domain information for newly observed domains can be leveraged. This newly observed domain information can be obtained from various domain query and response protocol databases that store registered users or assignees of domain names. This registration information with holographic similarity is present and content comparison from landing page images can be performed when the registration information does not indicate that the domains are commonly owned.

In one illustrative example, a computer implemented method detects suspicious domains. A computer system determines a homographic similarity between a target domain and a known domain. The computer system compares first registration information for the target domain and second registration information for the known domain to form a registration comparison in response the homographic similarity being sufficiently similar to be potentially suspicious. The computer system compares a set of first landing page images for the target domain and a set of second landing page images for the known domain to form an image comparison in response to a match between the first ownership information for the target domain and the second ownership information for the known domain being absent. The computer system determines a threat level for the target domain based on the image comparison.

With reference now to the figures and, in particular, with reference toFIG.1, a pictorial representation of a network of data processing systems is depicted in which illustrative embodiments may be implemented. Network data processing system100is a network of computers in which the illustrative embodiments may be implemented. Network data processing system100contains network102, which is the medium used to provide communications links between various devices and computers connected together within network data processing system100. Network102may include connections, such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server computer104and server computer106connect to network102along with storage unit108. In addition, client devices110connect to network102. As depicted, client devices110include client computer112, client computer114, and client computer116. Client devices110can be, for example, computers, workstations, or network computers. In the depicted example, server computer104provides information, such as boot files, operating system images, and applications to client devices110. Further, client devices110can also include other types of client devices such as mobile phone118, tablet computer120, and smart glasses122. In this illustrative example, server computer104, server computer106, storage unit108, and client devices110are network devices that connect to network102in which network102is the communications media for these network devices. Some or all of client devices110may form an Internet of things (IoT) in which these physical devices can connect to network102and exchange information with each other over network102.

Client devices110are clients to server computer104in this example. Network data processing system100may include additional server computers, client computers, and other devices not shown. Client devices110connect to network102utilizing at least one of wired, optical fiber, or wireless connections.

Program instructions located in network data processing system100can be stored on a computer-recordable storage media and downloaded to a data processing system or other device for use. For example, program instructions can be stored on a computer-recordable storage media on server computer104and downloaded to client devices110over network102for use on client devices110.

In this example, suspicious domain classifier130is located in server computer104. Protected domains132is a list of known domains that are to be protected. As depicted, suspicious domain classifier130receives newly observed domain stream134for analysis. Newly observed the domain stream134includes target domains selected for processing to determine whether any of these target domains are considered suspicious domains with respect to the domains in protected domains132.

In this illustrative example, suspicious domain classifier130can determine whether a target domain in newly observed domain stream134is a homograph of a protected domain in protected domains132. In this illustrative example, letters in the target domain can be swapped out with the confusable characters. For example, a number “1” can look like a letter “l” and the letters “r” and “n” put together can look like the letter “m”. Further, the protected domain can also have letters swapped out with confusable characters. These results can be compared to determine whether the target domain is a homograph of the protected domain.

If the target domain is determined to be a homograph of the protected domain, suspicious domain classifier130can determine whether the two domains are under the same owner before performing additional analysis. This determination can be made using at least one of registration information or name servers in domain registration records such as WHOIS records. If the registration information indicates that the two domains are owned by the same owner, then the target domain is not considered suspicious. In some cases, the registration information for one or both domains may not be sufficient to make this comparison of ownership with a sufficient level of certainty. In this illustrative example, the registration may only include an owner name and not an email address or other information that can confirm that the target domain and the protected domain had the same owner. In this case, name servers can also be used to determine whether the two domains belong to the same owner.

If registration information indicates different owners or insufficient registration information is present, the content in the two domains can be analyzed. For example, images of the landing pages for the two domains can be compared. For example, randomly sampled images of the landing pages for the last 30 days can be obtained and compared for each domain to determine the similarity between the landing pages. If the similarity is greater than a threshold, the two domains can be considered similar.

If the similarity is less than the threshold, the target domain can be considered suspicious. In this case, the target domain can be considered a threat and an action can be taken such as generating an alert, sending a message, initiate removal of the target domain, or performing some other suitable action.

If the similarity between the landing pages for the target domain and the protected domain are not considered similar and the registration information cannot confirm that both domains belong to the same owner, the target domain can be flagged as suspicious. This information can be used in an analysis if the target domain becomes a threat at a later point in time.

With reference now toFIG.2, a block diagram of a suspicious domain environment is depicted in accordance with an illustrative embodiment. In this illustrative example, suspicious domain environment200includes components that can be implemented in hardware such as the hardware shown in network data processing system100inFIG.1.

In this illustrative example, suspicious domain identification system202comprises computer system204and suspicious domain classifier206. Suspicious domain classifier206is located in computer system204.

Suspicious domain classifier206can be implemented in software, hardware, firmware, or a combination thereof. When software is used, the operations performed by suspicious domain classifier206can be implemented in program instructions configured to run on hardware, such as a processor unit. When firmware is used, the operations performed by program instructions207can be implemented in program instructions and data and stored in persistent memory to run on a processor unit. When hardware is employed, the hardware can include circuits that operate to perform the operations in suspicious domain classifier206.

As depicted, computer system204includes a number of processor units205that are capable of executing program instructions207implementing processes in the illustrative examples. As used herein a processor unit in the number of processor units205is a hardware device and is comprised of hardware circuits such as those on an integrated circuit that respond and process instructions and program instructions that operate a computer. When a number of processor units205execute program instructions207for a process, the number of processor units205is one or more processor units that can be on the same computer or on different computers. In other words, the process can be distributed between processor units on the same or different computers in a computer system. Further, the number of processor units205can be of the same type or different type of processor units. For example, a number of processor units can be selected from at least one of a single core processor, a dual-core processor, a multi-processor core, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), or some other type of processor unit.

In this illustrative example, known domain208is a domain selected for protection. Threats or potential threats to known domain208can be identified by suspicious domain classifier206. Target domain210is a domain identified for analysis by suspicious domain classifier206to determine whether target domain210is suspicious or a threat with respect to known domain208. In one illustrative example, target domain210can be a newly observed domain received in a newly observed domain stream. In other illustrative examples, target domain210can be received in a request from a requester for analysis.

In response to homographic similarity212being sufficiently similar to be potentially suspicious, suspicious domain classifier206searches for first ownership information218for target domain210and second ownership information220for known domain208. The ownership information can be obtained using query and response protocols such as WHOIS to query databases of registered users for ownership information about domain names.

In this illustrative example, suspicious domain classifier206can compare first ownership information218for target domain210and second ownership information220for known domain208to form ownership comparison222in response to homographic similarity212being sufficiently similar to be potentially suspicious. The ownership information can include at least one of registration information, name servers, or other information that can be used to identify the owner of a domain. In this depicted example, sufficient registration information is present when a registered organization name and an email address are included in the registration information. If the registration information includes only a name, that information is considered to be insufficient to determine whether both domains belong to the same owner. In this case, the identification of name servers for the two domains can be used to determine whether the owner of the domains is the same, in addition to using the name in the registration information.

As depicted, suspicious domain classifier206can determine that target domain210is not suspicious in response to ownership comparison222indicating a match between first ownership information218of target domain210and second ownership information220of known domain208. A match is present when sufficient information is available in both first ownership information218and second ownership information220that matches each other.

For example, if both sets of ownership information include owner name and an email address and those two pieces of information match, then ownership comparison222indicates that a match is present between first ownership information218and second ownership information220. Thus, target domain210and known domain208are considered to be owned by the same owner and threat level229in this example can indicate that a threat is absent. On the other hand, if insufficient ownership information is present to compare ownership between target domain210and known domain208, then a match is absent between first ownership information218and second ownership information220.

In this illustrative example suspicious domain classifier206compares a set of first landing page images223for target domain210and a set of second landing page images224for known domain208to form image comparison225in response to a match between ownership information between target domain210and known domain208being absent. In this illustrative example, image comparison225can be made using program instructions207suspicious domain classifier206.

In other illustrative examples, suspicious domain classifier206can make this determination using artificial intelligence system226. An artificial intelligence system is a system that has intelligent behavior and can be based on the function of a human brain. An artificial intelligence system comprises at least one of an artificial neural network, a cognitive system, a Bayesian network, a fuzzy logic, an expert system, a natural language system, or some other suitable system. Machine learning is used to train the artificial intelligence system. Machine learning involves inputting data to the process and allowing the process to adjust and improve the function of the artificial intelligence system.

In one illustrative example, artificial intelligence system226can comprise machine learning model228. A machine learning model is a type of artificial intelligence model that can learn without being explicitly programmed. A machine learning model can learn based on training data input into the machine learning model. The machine learning model can learn using various types of machine learning algorithms. The machine learning algorithms include at least one of a supervised learning, and unsupervised learning, a feature learning, a sparse dictionary learning, an anomaly detection, a reinforcement learning, a recommendation learning, or other types of learning algorithms. Examples of machine learning models include an artificial neural network, a convolutional neural network, a decision tree, a support vector machine, a regression machine learning model, a classification machine learning model, a random forest learning model, a Bayesian network, a genetic algorithm, and other types of models. These machine learning models can be trained using data and process additional data to provide a desired output.

With image comparison225, suspicious domain classifier206can determine threat level229for target domain210based on image comparison225. Suspicious domain classifier206performs this type of analysis for each domain selected for protection or monitoring. Based on threat level229, suspicious domain classifier206can form a set of actions232. The set of actions232can be selected from at least one of flagging target domain210for additional monitoring, generating an early warning, sending a message to a user, initiating a cybersecurity process, or other actions. For example, if threat level229indicates that target domain210is suspicious but not an actual threat, suspicious domain classifier206can store information about target domain210in suspicious domain database231for further monitoring or historical analysis. If threat level229indicates that target domain210is a threat, suspicious domain classifier206can generate an early warning such that the additional actions can be taken with respect to target domain210. These actions can be taken before target domain210becomes active if target domain210is not already active.

Turning toFIG.3, an illustration of a suspicious domain classifier is depicted in accordance with an illustrative embodiment. Components that can be used to implement suspicious domain classifier206are shown in this figure. As depicted, suspicious domain classifier206can include homographic detector300, owner analyzer302, and image comparator304. As depicted, these components form an intelligence generation pipeline for classifying target domains with respect to known domains selected for protection in performing threat intelligence curation.

Suspicious domain classifier206can operate to detect threats to known domains which are selected for protection. In this illustrative example, suspicious domain classifier206can operate to detect threats to known domains306. In this depicted example, known domains306are domains that have been selected for protection.

In this illustrative example, suspicious domain classifier206can receive target domains308from newly registered domain feed310and federated search312. Newly registered domain feed310can be received from sources such as Quad9, which is a domain name system (DNS) platform. Federated search312can be a search performed on multiple data sources such as domain name registry databases maintained by domain name registrars.

In this illustrative example, homographic detector300determines the homographic similarity between a target domain and a known domain. This homographic similarity can be determined by creating a canonicalized version of the target domain and the known domain. These canonicalized versions of the target domain and the known domain can be compared to determine the level of homographic similarity between these canonicalized versions.

If homographic similarity is at a level to be suspicious, then owner analyzer302operates to attempt to determine the ownership of the target domain and the known domain. This analysis can be performed using ownership information such as registration information, domain name servers, and other information that can be obtained from various sources. In one illustrative example, source can be WHOIS. If owner analyzer302determines that both the target domain and the known domain have the same owner, then the process can terminate or move to analyze another target domain.

In this case, the target domain is not a suspicious domain because of the common ownership. If insufficient information is present to determine ownership or the ownership information indicates that different owners are present, image comparator304performs content comparison between the target domain and the known domain. In this illustrative example, the content comparison compares the landing pages for the target domain and the known domain. In the illustrative example, image comparator304obtains screenshots of the landing pages for the target domain and the known domain.

These screenshots can be images of the landing pages over a period of time. For example, landing pages present for a 30 day period of time can be used for the comparison. In other illustrative examples, images from other periods of time such as 5 days, 60 days, or some other period of time can be used.

The images are compared by image comparator304to determine the similarity between images for the target domain and images for the known domain. A threshold level of similarity can be set for use in determining when images for landing pages between a target domain and a known domain are considered to be sufficiently similar to be considered to be a threat in response to an inability to determine that the two domains have the same owner. In other words, when the similarity exceeds the threshold, the target domain is not considered a threat. If the threshold is exceeded, then suspicious domain classifier206can generate early warning314. Early warning314can be a message, email, signal, or other indicator. Early warning314can be used to initiate action to prevent or eliminate potential issues that can be caused by the target domain that has been identified as a threat.

In this illustrative example, if the target domain does not have a landing page but is identified as having different owners based on insufficient information being present to determine owners, then the target domain is identified as a suspicious domain. This target domain can be added to suspicious domain database316. Additional information about the target domain such as name server, IP address, geography, or the information can be included. This information can be useful in the event that the target domain later becomes a threat. In this manner, and historical analysis can be performed to determine what suspicious target domains later become actual threats. The analysis may reveal various patterns such as suspicious domains from certain geographies often become threats.

Thus, suspicious domain classifier206provides an improved process for detecting suspicious domains including phishing domains based on homographic similarity, ownership analysis, and image similarity. In the illustrative example, suspicious domain classifier206provides lower false-positive rates as compared to currently available techniques. Further, improved accuracy occurs through comparison of landing page images using artificial intelligence system226and in particular machine learning model228inFIG.2.

In one illustrative example, one or more technical solutions are present that overcome a technical problem with the use of suspicious domains to divert traffic from known domains selected for protection. As a result, one or more technical solutions may provide a solution that detects suspicious domains by applying multiple types of analysis as a pipeline in curating threat intelligence related to domain names.

Computer system204can be configured to perform at least one of the steps, operations, or actions described in the different illustrative examples using software, hardware, firmware, or a combination thereof. As a result, computer system204operates as a special purpose computer system in which suspicious domain classifier206in computer system204enables detecting suspicious domains that may be a threat to known domains identified for protection. In particular, suspicious domain classifier206transforms computer system204into a special purpose computer system as compared to currently available general computer systems that do not have suspicious domain classifier206.

In the illustrative example, the use of suspicious domain classifier206in computer system204integrates different processes into a practical application detecting suspicious domains that increases the performance of computer system204in curating threat intelligence for protecting domains. In other words, suspicious domain classifier206in computer system204is directed to a practical application of processes integrated into suspicious domain classifier206in computer system204performs at least one of homographic detection, domain ownership detection, and image analysis of screenshots from landing pages of target domains and known domains.

With reference next toFIG.4, a dataflow diagram for comparing domain names for domains is depicted in accordance with an illustrative embodiment. As depicted, the dataflow in this figure can be implemented using suspicious domain classifier206and more specifically can be implemented in homographic detector300in suspicious domain classifier206inFIG.3.

In this illustrative example, the homographic similarity between known domain400and target domain402can be determined through canonicalization of known domain name404for known domain400and target domain name406for target domain402. As depicted, first canonicalized values408are generated using the string of known domain name404. Second canonicalized values410are identified using the string of target domain402.

In this illustrative example, first canonicalized values408from a database or data structure containing canonicalized values for known domains are selected for protection. First canonicalized values408are generated for known domain400prior to initiating the process in this flowchart and saved for quicker process initialization in this example. As a result, comparison420can be performed more quickly. Processor resource savings and time savings increase when thousands or tens of thousands of target domains are received for analysis. Thus, the identification of first canonicalized values408can be performed as a lookup in a database or other type of data structure.

In another illustrative example, second canonicalized values410are generated from target domain name406. In this implementation, first canonicalized values408do not need to be generated. Instead, second canonicalized values410can be compared to known domain name404to determine if a match is present. In yet another example, first canonicalized values408are generated and compared to target domain name406to determine if a match is present. With this example, second canonicalized values410are not generated as part of the comparison process.

Turning now toFIG.5, a data flow diagram for comparing images from a known domain and a target domain is depicted in accordance with an illustrative embodiment. The dataflow in this figure can be implemented using suspicious domain classifier206and more specifically can be implemented in image comparator304in suspicious domain classifier206inFIG.3. As depicted, known domain images500and target domain images502are identified for comparison. These images are screenshots of landing pages in the depicted examples. Landing pages can also be referred to as homepages in these examples. The comparison of these images is performed to determine whether the images are sufficiently similar to indicate that they are from the same source. In this illustrative example, this data flow can be implemented in an artificial intelligence system in the form of a machine learning model. More specifically, a convolutional neural network can be used in this dataflow.

In this illustrative example, known domain images500include valid page504, old page506, and error page508. Old page506is a screenshot of the page that is outside of the time used for comparison. For example, if the images are for screenshots of landing pages from the last 30 days, old page506may be from day 32. Error page508is a page that displays an error code.

Target domain images502include valid page1510, valid page2512, an empty page514. Empty page514is the image of the page that has no content.

In this example, invalid pages are removed from known domain images (block501). The result is known domain images516, which comprises valid page504. Invalid pages are removed from target domain images502(block503). This processing of target domain images502result in in target domain images518. In this example, target domain images518are valid page1510and valid page2514.

Next, known domain images516are embedded (block505). In this example, known domain images516comprises valid page504. This embedding results in known domain embeddings522which comprises a single embedding, known domain embedding524. Target domain images518are also embedded (block507). This embedding forms target domain embeddings526, which comprises target domain embedding1528and target domain embedding2530. In other words, each image that is embedded results in an embedding. This embedding takes the form of vectors of numbers that describe the images processed to produce these embeddings.

Cosine similarity is then determined for the embedding (block509), resulting in cosine similarity scores532. Cosine similarity is measured by the cosine of the angle between two vectors and determines whether the two vectors are pointing in roughly the same direction. A cosine similarity score of one is for similar and a cosine similarity score of zero is for unrelated in this illustrative example.

These scores than can be examined to determine whether images of the landing pages from the known domain and the target domain are sufficiently similar to not be considered suspicious or a threat. In this example, cosine similarity is determined between known domain embedding524and target domain embedding1528. In this illustrative example, cosine similarity measures the similarity between two vectors of an inner product space. In this illustrative example, the two vectors can be known domain embedding524and target domain embedding1528. The two vectors can also be known domain embedding524and target domain embedding2530. Cosine similarity is measured by the cosine of the angle between two vectors and determines whether two vectors are pointing in roughly the same direction. Cosine similarity is also determined between known domain embedding524and target domain embedding2530.

In this example, insufficient information is present to determine both the names have the same ownership or the ownership information indicates that different owners are present, resulting in comparing images from the known domain and the target domain to generate the cosine similarity scores532of the domains in a cosine similarity score matrix. If cosine similarity scores532is less than a similarity threshold, then the two images from the two domains are not sufficiently similar, and the target domain is not considered a threat. In other words, although different owners are present for the two domains, the landing pages are sufficiently different such that a user would not confuse the landing page for the target domain with the landing page for the known domain.

If cosine similarity scores532are equal to or greater than the similarity threshold, then the two images from the two domains are considered to be sufficiently similar. In one illustrative example, the cosine similarity threshold can be 0.9.

If cosine similarity scores532indicate that the two domains are sufficiently similar, a determination can be made as to whether this score is due to an outlier. A determination of whether an outlier is present can be determined in block509by calculating the average absolute distance from the mean and dividing the absolute difference of each score by the average. This determination is less sensitive version of a standard deviation for normalized vector similarity scores. If the maximum similarity after this pruning step is still above the threshold, the image comparison step generates an early warning identifying the target domain as a threat.

In this example, if a subsequent comparison of the domains at the image comparison step results in cosine similarity scores532being equal to or greater than the similarity threshold and cosine similarity scores532were previously less than the similarity threshold at the image comparison step, an analysis can be performed on cosine similarity scores532in the future to determine if the generation of the early warning identifying the target domain as a threat. For example, two domains have cosine similarity scores532of 0.5, which are less than the similarity threshold of 0.9 in a number of past comparisons. In this example, a subsequent comparison of the two domains generates cosine similarity scores532equal to or greater than the similarity threshold of 0.9. In this example, an analysis can be performed at the image comparison step using new screenshots of the known domain and the target domain to determine whether the new scores are outliers.

In the illustrative example, the embedding performed in block505and block507can be implemented using a machine learning model. For example, the machine learning model can be a convolutional neural network (CNN). In this example, the convolutional neural network operates as an image embedding model to generate embedding of the images in the form of vectors for comparison.

For example, the convolutional neural network can be trained on triplets of images. The three images in a triplet include (1) a baseline image, known as the anchor; (2) a positive example, which is a screenshot under the same domain; and (3) a negative example, a randomly selected screenshot from outside the domain. The anchor to positive model is trained to predict a similarity of 1. This model is a first image comparison model. The anchor to negative is trained to predict a similarity of 0. This model is the second image comparison model. When two comparisons are performed using these two models, those comparisons provide sufficient evidence during training to consider the vectors of the 3 images to be the fingerprints of the compared images.

In the illustrative example, the training process randomly samples a screenshot for a particular domain. This first screenshot is used as anchor. The process randomly samples another screenshot under that same domain. This second screenshot is used as positive reference. The process randomly samples a screenshot for any other domain. This third screen shot is used as negative reference.

The process embeds all 3 images, resulting in 3 vectors. The process calculates cosine similarity between anchor and positive vectors and calculates the cosine similarity between anchor and negative vectors. The process retunes embedding model and comparison models such that the anchor generates positive scores as 1 and anchor generates negative scores as 0. The retuned embedding model can be used to generate the vectors for the cosine similarity check performed in block509.

With reference toFIG.6, a flowchart of a process for detecting suspicious target domains is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.6can be implemented using computer system204inFIG.2. For example, the process can be implemented in suspicious domain classifier206in computer system204in domain identification system202inFIG.2.

The process begins by determining a homographic similarity between a target domain and a known domain (step600). The process compares first ownership information for the target domain and second ownership information for the known domain to form an ownership comparison in response to the homographic similarity being sufficiently similar to be potentially suspicious (step602).

The process compares a set of first landing page images for the target domain and a set of second landing page images for the known domain to form an image comparison in response to a match between the first ownership information for the target domain and the second ownership information for the known domain being absent (step604). The process determines a threat level for the target domain based on the image comparison (step606). The process terminates thereafter.

Turning next toFIG.7, a flowchart of a process for determining a target domain to be not suspicious based on an ownership comparison is depicted in accordance with an illustrative embodiment. The step in this figure is an example of an additional step that can be used within the steps in the process inFIG.6.

The process determines the target domain to be not suspicious in response to the ownership comparison indicating a match between the first ownership information of the target domain and the second ownership information of the known domain (step700). The process terminates thereafter.

With reference toFIG.8, a flowchart of a process for determining homographic similarity is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.8is an example of one implementation for step600inFIG.6.

The process begins by determining a first canonicalized values for the known domain (step800). In this example, step800can be performed as a look of first canonicalized values for the known domain that were previously generated. In other examples, the generation of the first canonicalized values can occur in step800. The process determines a second canonicalized values for the target domain (step802).

The process compares the first canonicalized values to the second canonicalized values to determine the homographic similarity, wherein the homographic similarity is sufficiently similar to be potentially suspicious in response to the first canonicalized values and the second canonicalized values matching within a preselected threshold for the homographic similarity (step804). The process terminates thereafter.

Turning next toFIG.9, a flowchart of a process for generating canonicalized strings for a known domain is depicted in accordance with an illustrative embodiment. The process inFIG.9can be implemented in hardware, software, or both. When implemented in software, the process can take the form of program instructions that is run by one of more processor units located in one or more hardware devices in one or more computer systems. For example, the process can be implemented in suspicious domain classifier206in computer system204inFIG.2.

The process begins by identifying a known domain selected for protection (step900). The process selectively removes any diacritics present for characters in the string for the known domain name are selectively removed (step902). A diacritic is a sign associated with the character. For example, a diacritic can be accent or cedilla.

The process identifies characters in the string that are homoglyphs (step904). In step904, the process determines whether one or more other characters appear identical or very similar to the character been processed. For example, when next to each other “r” and “n” can resemble “m” This determination can be made using a Unicode character set containing Unicode homoglyphs of characters also referred to as confusables.

The process generates canonicalized strings with different permutations of character replacement of characters identified as being homoglyphs in the string (step906). The process saves the canonicalized strings for the known domain in a database (step908). The process terminates thereafter.

This process inFIG.9can be performed for known domains that is selected for protection. The results of this process can be saved in a database for faster comparisons to identify target domains with homographic similarity to known domains.

With reference now toFIG.10, a flowchart of a process for comparing images from a known domain and a target domain is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.10can be implemented using computer system204inFIG.2. For example, the process can be implemented in suspicious domain classifier206in computer system204inFIG.2.

The process begins by retrieving screenshots of known domain images and target domain images (step1000). The process filters invalid pages from the screenshots of the known domain images and the target domain images (step1002). The process embeds valid pages from the screenshots of the known domain images and the target domain images to form vectors for the known domain images and the target domain images (step1004).

The process determines a cosine similarity for the vectors for the known domain images and the target domain images resulting in a cosine similarity score matrix for the known domain images and the target domain images (step1006). The cosine similarity score matrix is a data structure that contains scores between the images. For example, if 2 know domain images and 3 target domain images are embedded and compared, the cosine similarity score matrix is a 2 by 3 matrix with each score representing an image from the known domain and an image from the target domain. In this depicted example, if 1 know domain image and 2 target domain images are embedded and compared, the cosine similarity score matrix is a 1 by 2 matrix.

A determination is made as to whether cosine similarity scores in the cosine similarity score matrix exceed a similarity threshold (step1008). If none of the cosine similarity scores exceed the similarity threshold, the process generates an aggregated report (step1010). The process terminates thereafter.

With reference again to step1008, if the cosine similarity scores exceed a similarity threshold, then the process analyzes outlying cosine similarity scores in the similarity score matrix (step1012). The process removes outlying cosine similarity scores that are identified as outlier cosine similarity scores from the similarity score matrix (step1014). A determination is made as to whether the cosine similarity scores in the cosine similarity score matrix exceed the similarity threshold (step1016). If none of the cosine similarity scores exceed the similarity threshold, then the process generates an aggregated report (step1010). The process terminates thereafter. With reference again to step1016, if the cosine similarity scores exceed the similarity threshold, then the process generates an early warning (step1018). The process generates an aggregated report (step1010). The process terminates thereafter.

With reference now toFIG.11, a flowchart of a process for comparing landing pages from a known domain and a target domain is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.11is an example of one implementation for step604inFIG.6.

The process determines a cosine similarity between the set of first landing page images and the set of second landing page images (step1100). The process terminates thereafter.

Turning next toFIG.12, a flowchart of a process for comparing landing pages from a known domain and a target domain using a cosine similarity between images is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.12is an example of one implementation for step604inFIG.6.

The process begins by determining a set of known domain embeddings (step1200). The process determines a set of target domain embeddings (step1202). The process determines a cosine similarity between the set of first landing page images and the set of second landing page images using the set of known domains embeddings and the set of target domain embeddings (step1204). The process terminates thereafter.

With reference toFIG.13, a flowchart of a process for comparing landing page images from a known domain and a target domain is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.13is an example of one implementation for step604inFIG.6.

The process compares the set of first landing page images for the target domain and the set of second landing page images for the known domain using a machine learning model to form the image comparison, wherein the machine learning model is trained to compare images and determine a similarity between the images for the image comparison (step1300). The process terminates thereafter.

Turning toFIG.14, a flowchart of a process for determining threat level for a target domain is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.14is an example of one implementation for step606inFIG.6.

The process determines the target domain to be a threat in response to the image comparison indicating that content in the set of first landing page images and the set of second landing page images sufficiently similar to be confusing and the known domain and the target domain are not owned by a same owner (step1400). The process terminates thereafter.

Turning next toFIG.15, a flowchart of a process for determining a threat level for a target domain is depicted in accordance with an illustrative embodiment. The process illustrated inFIG.15is an example of one implementation for step606inFIG.6.

The process determines the target domain to be suspicious in response to the image comparison indicating that content in the set of first landing pages image and the set of second landing page images are not sufficiently similar to be confusing and the known domain and the target domain are not owned by a same owner (step1500). The process terminates thereafter.

Turning now toFIG.16, a block diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system1600can be used to implement server computer104, server computer106, client devices110, inFIG.1. Data processing system1600can also be used to implement computer system204inFIG.2. In this illustrative example, data processing system1600includes communications framework1602, which provides communications between processor unit1604, memory1606, persistent storage1608, communications unit1610, input/output unit1612, and display1614. In this example, communications framework1602takes the form of a bus system.

Processor unit1604serves to execute instructions for software that can be loaded into memory1606. Processor unit1604includes one or more processors. For example, processor unit1604can be selected from at least one of a multicore processor, a central processing unit (CPU), a graphics processing unit (GPU), a physics processing unit (PPU), a digital signal processor (DSP), a network processor, or some other suitable type of processor. Further, processor unit1604can may be implemented using one or more heterogeneous processor systems in which a main processor is present with secondary processors on a single chip. As another illustrative example, processor unit1604can be a symmetric multi-processor system containing multiple processors of the same type on a single chip.

Memory1606and persistent storage1608are examples of storage devices1616. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, at least one of data, program instructions in functional form, or other suitable information either on a temporary basis, a permanent basis, or both on a temporary basis and a permanent basis. Storage devices1616may also be referred to as computer-readable storage devices in these illustrative examples. Memory1606, in these examples, can be, for example, a random-access memory or any other suitable volatile or non-volatile storage device. Persistent storage1608may take various forms, depending on the particular implementation.

For example, persistent storage1608may contain one or more components or devices. For example, persistent storage1608can be a hard drive, a solid-state drive (SSD), a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage1608also can be removable. For example, a removable hard drive can be used for persistent storage1608.

Communications unit1610, in these illustrative examples, provides for communications with other data processing systems or devices. In these illustrative examples, communications unit1610is a network interface card.

Input/output unit1612allows for input and output of data with other devices that can be connected to data processing system1600. For example, input/output unit1612may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Further, input/output unit1612may send output to a printer. Display1614provides a mechanism to display information to a user.

Instructions for at least one of the operating system, applications, or programs can be located in storage devices1616, which are in communication with processor unit1604through communications framework1602. The processes of the different embodiments can be performed by processor unit1604using computer-implemented instructions, which may be located in a memory, such as memory1606.

These instructions are referred to as program instructions, computer usable program instructions, or computer-readable program instructions that can be read and executed by a processor in processor unit1604. The program instructions in the different embodiments can be embodied on different physical or computer-readable storage media, such as memory1606or persistent storage1608.

Program instructions1618is located in a functional form on computer-readable media1620that is selectively removable and can be loaded onto or transferred to data processing system1600for execution by processor unit1604. Program instructions1618and computer-readable media1620form computer program product1622in these illustrative examples. In the illustrative example, computer-readable media1620is computer-readable storage media1624.

Computer-readable storage media1624is a physical or tangible storage device used to store program instructions1618rather than a medium that propagates or transmits program instructions1618. Computer-readable storage media1624, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

Alternatively, program instructions1618can be transferred to data processing system1600using a computer-readable signal media. The computer-readable signal media are signals and can be, for example, a propagated data signal containing program instructions1618. For example, the computer-readable signal media can be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals can be transmitted over connections, such as wireless connections, optical fiber cable, coaxial cable, a wire, or any other suitable type of connection.

Further, as used herein, “computer-readable media1620” can be singular or plural. For example, program instructions1618can be located in computer-readable media1620in the form of a single storage device or system. In another example, program instructions1618can be located in computer-readable media1620that is distributed in multiple data processing systems. In other words, some instructions in program instructions1618can be located in one data processing system while other instructions in program instructions1618can be located in one data processing system. For example, a portion of program instructions1618can be located in computer-readable media1620in a server computer while another portion of program instructions1618can be located in computer-readable media1620located in a set of client computers.

The different components illustrated for data processing system1600are not meant to provide architectural limitations to the manner in which different embodiments can be implemented. In some illustrative examples, one or more of the components may be incorporated in or otherwise form a portion of, another component. For example, memory1606, or portions thereof, may be incorporated in processor unit1604in some illustrative examples. The different illustrative embodiments can be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system1600. Other components shown inFIG.16can be varied from the illustrative examples shown. The different embodiments can be implemented using any hardware device or system capable of running program instructions1618.

Thus, illustrative embodiments of the present invention provide a computer implemented method, computer system, and computer program product for detecting suspicious domains. In one illustrative example, a determination is made as to whether to domains, a known domain and a target domain are similar enough that the target domain may be a suspicious domain. This determination can be made by determining homographic similarity in which the domain name string of the two domains are canonicalized for comparison.

If the two domains are sufficiently similar enough, a determination is made as to whether the two domains are owned by the same owner. Ownership information such as registrant information and name servers in various databases of registered users of domain names can be used. If enough registration information is present for both domains, the comparison can be made just using the registration information. If insufficient information is present, such as only an organization name, the name servers can also be used. If overall insufficient information is present, then images from landing pages for the two domains are compared. If the images are not sufficiently similar, then the target domain is not considered a threat. Otherwise, an early warning threat alert can be made identifying the target domain as a threat.

As a result, this type of threat information can be sufficiently accurate for various organizations for use in current hunting and incident response. Additionally, these types of comparisons and alerts can be useful in brand monitoring functionality performed for various clients and their domains.