Abstract:
Outbound communication from a computer is monitored, and requests to access remote links are identified. This process identifies attempts by users to access links provided by third parties in emails and such, as well other attempts by users to access remote domains. Domains in the identified requests are profiled, by testing them for properties associated with known legitimate domains, and for properties associated with known fraudulent domains. A trustworthiness score for a domain is calculated based on the results of the profiling. The trustworthiness score is compared to a predetermined threshold, and from the results it is determined whether or not the domain is legitimate. If the domain is fraudulent, appropriate action is taken, such as blocking the attempt to access the domain.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer security, and more specifically to detecting suspicious domains through the use of domain profiling. 
     BACKGROUND 
     Phishing is a serious computer security threat. Phishing involves an attempt to criminally and fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy entity (e.g., eBay, PayPal, a known bank) in an electronic communication. Phishing is typically carried out by email or instant messaging, and directs users to enter details at a fraudulent website which is disguised to look legitimate. Once the user enters the personal information, it is used for fraudulent purposes such as identity theft. 
     Anti-phishing software packages exist today, which employ various technical solutions to detect and block phishing attacks. Such anti-phishing solutions attempt to identify websites that users are being directed towards in electronic communications, and distinguish between legitimate and fraudulent websites. An electronic communication encouraging a user to link to a non-legitimate website can be identified as a phishing attack. 
     Unfortunately, phishing attacks are becoming ever more sophisticated, and consequently phishing web sites are becoming progressively more difficult to programmatically detect. Phishing groups such as Rock Phish are increasingly using more advanced techniques such as enterprise style failover and redundancy. These strategies ensure maximum uptime of their fraudulent web sites, while also reducing the ability to detect their attacks. One weakness still present in these techniques is their rampant use of throw-away domain names. These and other phishing techniques frequently change the fraudulent domains that they utilize to attempt to trick users into entering personal information. 
     It would be desirable to be able to reliably detect more types of phishing attacks, including those utilizing enterprise style failover and redundancy techniques. 
     SUMMARY 
     Links in emails and other electronic communications are profiled, to determine whether a link is to a legitimate or a fraudulent domain. More specifically, outbound communication from a computer is monitored, and requests to access remote links are identified. This process identifies attempts by users to access links provided by third parties in emails and such, as well other attempts by users to access remote domains. Domains in the identified requests are profiled, by testing them for properties associated with known legitimate domains, and for properties associated with known fraudulent domains. A trustworthiness score for a domain is calculated based on the results of the profiling. The trustworthiness score is compared to a predetermined threshold, and from the results it is determined whether or not the domain is legitimate. If the domain is fraudulent, appropriate action is taken. For example, the attempt to access the domain can be blocked, the user can be warned that the domain is fraudulent, information concerning the domain can be reported to a computer security service, etc. 
     The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating a system for detecting suspicious domains through the use of domain profiling, according to some embodiments of the present invention. 
     
    
    
     The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a system  100  for detecting suspicious domains  101  through the use of domain  101  profiling, according to some embodiments of the present invention. It is to be understood that although various components are illustrated in  FIG. 1  as separate entities, each illustrated component represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a component is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     As illustrated in  FIG. 1 , a domain profiling component  103  profiles domains  101 , to determine their trustworthiness. By inspecting a domain  101  and its associated properties, the domain profiling component  103  can programmatically determine whether the domain  101  is or is not legitimate. A transmission monitoring component  105  monitors outbound transmissions  107  originating from a computer  109 , and identifies requests  111  to access remote domains  101  (e.g., by identifying a Uniform Resource Locator (“URL”) in the request  111 ). In one embodiment, the transmission monitoring component  105  comprises a Hypertext Transfer Protocol (“HTTP”) proxy (either local, as illustrated, or remote) that is capable of detecting domain access requests  111  in the outbound HTTP stream. In another embodiment, the transmission monitoring component  105  is instantiated as a web browser plug-in that has access to domain access requests  111 . In any case, when a domain access request  111  is detected in an outbound transmission  107 , enough information from the request  111  to profile the domain  101  targeted thereby (e.g., the URL, the whole request  111 , the resolved domain name, etc.) is passed to the domain profiling component  103  to be profiled. 
     The implementation mechanics of detecting domain access requests  111  in outbound transmissions  107  and instantiating (local and remote) HTTP proxies and web browser plug-ins are known to those of ordinary skill in the relevant art. The use thereof within the context of the present invention will be readily apparent to one of such a skill level in light of this specification. In  FIG. 1  the domain profiling component  103  is illustrated as running on the local computer. In other embodiments, the domain profiling component  103  runs remotely, for example on a central server (not illustrated). 
     The domain profiling component  103  takes each domain  101  that is passed in, and performs a wide range of profiling methods thereon, with the goal of providing a score  113  which functions as a measure of trustworthiness. It is understood by those of ordinary skill in the relevant art that various properties are associated with legitimate domains  101 , and various other properties with fraudulent domains  101 . The domain profiling component  103  tests domains  101  for known properties. The profiling methodologies can include but are not limited to those described below. No single profiling method is a definitive test to determine whether a domain is legitimate or not. However, by running a plurality of tests and scoring the results, the domain profiling component  103  is able to determine with an acceptable level of accuracy whether a given domain is or is not fraudulent. 
     It is to be understood that which of the following or other tests to perform is a variable design parameter. It is to be further understood that the profiling tests explained below are simply examples. Other possible profiling tests will be readily apparent to one of ordinary skill in the relevant art in light of this specification. Additionally, how specifically to calculate the score  113  based on the test results is also a variable design parameter. Depending upon the tolerance or lack thereof for false positives and/or false negatives, the current trends in phishing attacks, etc., the trustworthiness score  113  can be increased or decreased by desired amounts according to the results of the various performed profiling tests. Different weights can be assigned to different test results as desired. 
     The length of time a domain  101  has been in existence can be checked. The more recently a domain  101  was registered, the more likely it is fraudulent. Although a recently registered domain  101  could be legitimate, phishing attacks recycle domains  101  very rapidly, whereas legitimate websites remain in use for long periods of time. Domains  101  that have been in existence for longer than a given time period (e.g., one year), are considered to be progressively less likely to be fraudulent based on age. 
     If the domain name  101  is found on a list of free anonymous web hosts (such as geocities.com), the likelihood of fraud is adjudicated as being greater. Such hosts are frequently used in phishing attacks because of their anonymity. The Internet Protocol (“IP”) address of the hosting server IP for the domain name  101  can be checked against a list of Digital Subscriber Line (“DSL”), cable modem or dialup network IP address ranges. If the domain  101  is found to be hosted on an IP address in one of these ranges, the likelihood of fraud is considered to be greater. On the other hand, if the domain name  101  is found to be hosted on a large co-location network (such as Akamai), the trust level increases. 
     If the domain name  101  is found in a well known and trusted directory (e.g., the Yahoo! Directory, DMOZ/Google Directory), the trust level is increased (proportional to the number of entries found). Additionally, if the domain name  101  is assigned to the same entity as the resolved IP address, the trust level increases (there is typically no penalty for a mismatch). This test indicates whether a company is large enough to host their own servers, a sign of legitimacy. 
     The fraud level is increased as the number of sub-domains  101  increases. For example, www.name.com is considered less likely to be fraudulent than abc.xyz.qfp.lfm.name.com. If the domain name  101  uses a high-fraud top level domain (“TLD”), such as .info or .biz, the fraud level is increased. Additionally, if the link is requesting that the recipient connect on a nonstandard port (e.g., a port other than 80/443), the fraud level is increased. 
     If the geo-location of the registered owner, technical contact, or domain contact is in close proximity to the geo-location associated with the IP address, the fraud level is decreased. If the expiration date of the domain  101  is more than, e.g., one year away, the fraud level is decreased. If the server has an associated valid Secure Socket Layer (“SSL”) certificate (e.g., a port  443  connection is made), the fraud level is decreased. 
     After the desired profiling tests are performed on the domain  101 , the resulting score  113  is compared to a predetermined threshold  115 . Of course, the specific threshold  115  to use is a variable design parameter. Depending upon the calculated score  113  relative to the predetermined threshold  115 , the domain  101  is identified as either fraudulent or legitimate. If the domain  101  is adjudicated as being legitimate, the user is typically allowed to access it. If the domain  101  is identified as being fraudulent, various possible steps can be taken as desired. For example, the user could be cautioned, the attempted access could be blocked, the domain  101  could be reported to a central security service, etc. 
     In the above described embodiment, the domain profiling component  103  performs specific profiling tests and adjusts the trustworthiness score  113  up or down based on the results. In another embodiment, the domain profiling component  103  is implemented as a statistical engine such as a neural network or Bayesian filter (not illustrated) that executes similar logic, in which desired profiling tests are features. The statistical engine is trained from known legitimate and known fraudulent domains  101  to produce a more statistically correct weighting for the various features. The implementation mechanics of instantiating a statistical engine that performs such statistical analysis is within the skill set of one of ordinary skill in relevant art, and the use thereof will be readily apparent to one of such a skill level in light of this specification. 
     It is to be understood that domain  101  profiling as described herein is a very useful tool in the detection and management of phishing attacks. Of course, such profiling of domains  101  is not limited to anti-phishing solutions, but can also be utilized in any implementation in which it is desirable to distinguish between legitimate and illegitimate domains  101 . 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable media as computer program products. Any form of computer readable medium can be used in this context, such as magnetic or optical storage media. Additionally, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any programmable computing device. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.