Patent ID: 12255908

DETAILED DESCRIPTION

In the following description of the various embodiments to accomplish the foregoing, reference is made to the accompanying drawings, which form a part hereof, and in which is shown by way of illustration, various embodiments in which the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made. It is noted that various connections between elements are discussed in the following description. It is noted that these connections are general and, unless specified otherwise, may be direct or indirect, wired, or wireless, and that the specification is not intended to be limiting in this respect.

As used throughout this disclosure, any number of computers, machines, or the like can include one or more general-purpose, customized, configured, special-purpose, virtual, physical, and/or network-accessible devices such as: administrative computers, application servers, clients, cloud devices, clusters, compliance watchers, computing devices, computing platforms, controlled computers, controlling computers, desktop computers, distributed systems, enterprise computers, instances, laptop devices, monitors or monitoring systems, nodes, notebook computers, personal computers, portable electronic devices, portals (internal or external), servers, smart devices, streaming servers, tablets, web servers, and/or workstations, which may have one or more application specific integrated circuits (ASICs), microprocessors, cores, executors etc. for executing, accessing, controlling, implementing etc. various software, computer-executable instructions, data, modules, processes, routines, or the like as discussed below.

References to computers, machines, or the like as in the examples above are used interchangeably in this specification and are not considered limiting or exclusive to any type(s) of electrical device(s), or component(s), or the like. Instead, references in this disclosure to computers, machines, or the like are to be interpreted broadly as understood by skilled artisans. Further, as used in this specification, computers, machines, or the like also include all hardware and components typically contained therein such as, for example, ASICs, processors, executors, cores, etc., display(s) and/or input interfaces/devices, network interfaces, communication buses, or the like, and memories or the like, which can include various sectors, locations, structures, or other electrical elements or components, software, computer-executable instructions, data, modules, processes, routines etc. Other specific or general components, machines, or the like are not depicted in the interest of brevity and would be understood readily by a person of skill in the art.

As used throughout this disclosure, software, computer-executable instructions, data, modules, processes, routines, or the like can include one or more: active-learning, algorithms, alarms, alerts, applications, application program interfaces (APIs), artificial intelligence, approvals, asymmetric encryption (including public/private keys), attachments, big data, CRON functionality, daemons, databases, datasets, datastores, drivers, data structures, emails, extraction functionality, file systems or distributed file systems, firmware, governance rules, graphical user interfaces (GUI or UI), images, instructions, interactions, Java jar files, Java Virtual Machines (JVMs), juggler schedulers and supervisors, load balancers, load functionality, machine learning (supervised, semi-supervised, unsupervised, or natural language processing), middleware, modules, namespaces, objects, operating systems, platforms, processes, protocols, programs, rejections, routes, routines, security, scripts, tables, tools, transactions, transformation functionality, user actions, user interface codes, utilities, web application firewalls (WAFs), web servers, web sites, etc.

The foregoing software, computer-executable instructions, data, modules, processes, routines, or the like can be on tangible computer-readable memory (local, in network-attached storage, be directly and/or indirectly accessible by network, removable, remote, cloud-based, cloud-accessible, etc.), can be stored in volatile or non-volatile memory, and can operate autonomously, on-demand, on a schedule, spontaneously, proactively, and/or reactively, and can be stored together or distributed across computers, machines, or the like including memory and other components thereof. Some or all the foregoing may additionally and/or alternatively be stored similarly and/or in a distributed manner in the network accessible storage/distributed data/datastores/databases/big data etc.

As used throughout this disclosure, computer “networks,” topologies, or the like can include one or more local area networks (LANs), wide area networks (WANs), the Internet, cloud networks, anonymization networks, wired networks, wireless networks, digital subscriber line (DSL) networks, frame relay networks, asynchronous transfer mode (ATM) networks, virtual private networks (VPN), or any direct or indirect combinations of the same. They may also have separate interfaces for internal network communications, external network communications, and management communications. Virtual IP addresses (VIPs) may be coupled to each if desired. Networks also include associated equipment and components such as access points, adapters, buses, ethernet adaptors (physical and wireless), firewalls, hubs, modems, routers, and/or switches located inside the network, on its periphery, and/or elsewhere, and software, computer-executable instructions, data, modules, processes, routines, or the like executing on the foregoing. Network(s) may utilize any transport that supports HTTPS or any other type of suitable communication, transmission, and/or other packet-based protocol.

By way of non-limiting disclosure,FIG.1depicts a sample architectural diagram in accordance with one or more information-security aspects of this disclosure as they relate to implementation in the context of a cloud network with varying exit nodes.

One or more terminal(s)100are coupled to servers102, such as control servers, which have local or network access to datastore(s)104, databases, data structures, etc. Datastore(s)104may serve as a repository for, inter alia, a list of target domains to monitor, alerts, results and notifications, polymorphic algorithms, user agents, node information, anonymization information, etc. Obfuscation criteria and data may be stored as well.

Process(es) running on the control server(s)102may access an obfuscation layer108or infrastructure by initiating a secure shell login (SSH)106in order to access a cloud network. Traffic generated by the server102can be controlled and routed through the cloud network (e.g., Amazon E2C server with its control server, IPSec tunnel to load balancer(s))110and exit through randomized exit nodes112-1,112-2,112-3,112-4,112-5. . .112-N. This helps mask and obfuscate the origin of the requests to make it more difficult for the target domains to detect and attempt to counter monitoring activity. Traffic exiting the cloud network can utilize dynamic user agents114by spoofing them to further increase the difficulty of detection.

Obfuscated requests are blended in with normal traffic that traverses the Internet to reach the target domains118-1. . .118-N that are being monitored for potential phishing, pharming, infringement, etc.

By way of non-limiting disclosure,FIG.2depicts a sample architectural diagram in accordance with one or more information-security aspects of this disclosure as they relate to implementation in the context of an anonymization network. Terminal(s)100, control server(s), and datastore(s)104can operate in the same way as inFIG.1. Of course, the threat targets118-1. . .118-N remain the same as well.

FIG.2differs fromFIG.1in that an anonymizing infrastructure202is utilized as part of an obfuscation layer200to obfuscate requests issued to the target domain. Traffic entering the anonymization network can be received by an entry/guard relay204and be passed through a series of middle relays206,208,210, and then exit through an exit relay212. An example implementation of this type could be a Tor network.

By way of non-limiting disclosure,FIG.3depicts a sample flow diagram for in accordance with one or more information-security aspects of this disclosure as they relate to implementation in the context of a cloud network with varying exit nodes.

A threat domain to monitor can be identified in300. This could be initiated from terminal(s)100by adding a domain to a target list, selecting a domain manually or automatically from a list, automatic adding of a domain to the list by virtue of detection of registration of the domain, etc. For any given monitoring workflow, a delay for monitoring requests302(randomized or determined algorithmically) may be implemented to help increase the difficulty of detection by introducing unpredictability into the process. For an initial monitor, there is no need for a delay and the process may be commenced immediately or on a particular schedule. However, subsequent monitoring activity is preferably at varying intervals to make it difficult for the threat actor to detect.

A determination can be made with respect to a polymorphic non-attributable profile for obfuscation to present to threat domain in304. This may include dynamic selection of characteristics for the proposed obfuscation request. A selection or determination can be made as to whether the request should be made at a network request level or at an application level. Obfuscation may be utilized to blend requests into normal traffic to domain (e.g., by spoofing user agent, etc. so that request will appear as though it originated from a residential IP address in a particular geographical location and therefore will be less suspicious to the threat actor).

In306, a connection may be made to a managed cloud network (e.g., Amazon E2C server) via secure shell protocol (SSH) to use as a proxy. A dynamic selection of an exit node may be made to mask origination information for the obfuscated request in308and the target domain may be contacted thereafter in310.

A determination may be first made as to whether the domain resolves in312. For example, if the domain is registered and a monitoring request is issued to the domain before it is live, the domain will not resolve. The result of that determination may be stored in326and the process may be repeated at a later time to detect when the site goes live.

If the domain resolves312, a determination may next be made as to whether it is accessible in314. If not, the results may be stored326and a subsequent monitoring attempt may be commenced at a later date and/or time. If the domain is accessible314, then the site can be captured and different responses from threat domain based on the profile in use can be used to determine variations (e.g., whether the same website is presented from everywhere irrespective of the location of the request or whether the request is originating from a residential IP address, or whether different websites are presented for different request originations), and a fingerprint for the website can be generated in316.

If this is the first time the target is observed or if fingerprint changed, screenshot(s) of the website can be captured in318.

If the website represents itself as being secure (e.g., by HTTPS:// . . . ) in320, security certificate information can be captured in322.

Thereafter, responses from the threat domain can be scanned in324for threat indicia (e.g., logos, brand infringement, or other identifiers of pharming, phishing, etc.). And the results may be stored in326.

If a threat is detected in328, a threat response workflow or process may be commenced in330. Notifications and/or alerts can be generated and sent automatically as desired in332.

By way of non-limiting disclosure,FIG.4depicts a sample architectural diagram in accordance with one or more information-security aspects of this disclosure as they relate to implementation in the context of an anonymization network.

The example ofFIG.4is similar toFIG.3but differs in that an anonymization network is utilized as part of the obfuscation layer.

Like withFIG.3, a threat domain to monitor can be identified in400. This could be initiated from terminal(s)100by adding a domain to a target list, selecting a domain manually or automatically from a list, automatic adding of a domain to the list by virtue of detection of registration of the domain, etc. For any given monitoring workflow, a delay for monitoring requests402(randomized or determined algorithmically) may be implemented to help increase the difficulty of detection by introducing unpredictability into the process. For an initial monitor, there is no need for a delay and the process may be commenced immediately or on a particular schedule. However, subsequent monitoring activity is preferably at varying intervals to make it difficult for the threat actor to detect.

Again, a determination can be made with respect to a polymorphic non-attributable profile for obfuscation to present to threat domain in404. This may include dynamic selection of characteristics for the proposed obfuscation request. A selection or determination can be made as to whether the request should be made at a network request level or at an application level. Obfuscation may be utilized to blend requests into normal traffic to domain (e.g., by spoofing user agent, etc. so that request will appear as though it originated from a residential IP address in a particular geographical location and therefore will be less suspicious to the threat actor).

A website request may be generated (e.g., by Python library) in406. The request can be transmitted to an anonymization node in408. The anonymization network can be traversed in410and exited in412. Contact with the threat domain can be established in414.

A determination may be first made as to whether the domain resolves in416. For example, if the domain is registered and a monitoring request is issued to the domain before it is live, the domain will not resolve. The result of that determination may be stored in430and the process may be repeated at a later time to detect when the site goes live.

If the domain resolves416, a determination may next be made as to whether it is accessible in418. If not, the results may be stored430and a subsequent monitoring attempt may be commenced at a later date and/or time. If the domain is accessible418, then the site can be captured and different responses from threat domain based on the profile in use can be used to determine variations (e.g., whether the same website is presented from everywhere irrespective of the location of the request or whether the request is originating from a residential IP address, or whether different websites are presented for different request originations), and a fingerprint for the website can be generated in420.

If this is the first time the target is observed or if fingerprint changed, screenshot(s) of the website can be captured in422.

If the website represents itself as being secure (e.g., by HTTPS:// . . . ) in424, security certificate information can be captured in426.

Thereafter, responses from the threat domain can be scanned in428for threat indicia (e.g., logos, brand infringement, or other identifiers of pharming, phishing, etc.). And the results may be stored in430.

If a threat is detected in432, a threat response workflow or process may be commenced in434. Notifications and/or alerts can be generated and sent automatically as desired in436.

The foregoing presents various arrangements and options for implementing a polymorphic non-attributable website monitor and monitoring process. This enables the surreptitious monitoring of threat domains and real-time capturing and mitigation of threats.

Although the present technology has been described in detail for the purpose of illustration based on what is currently considered to be the most practical and preferred implementations, it is to be understood that such detail is solely for that purpose and that the technology is not limited to the disclosed implementations, but, on the contrary, is intended to cover modifications and equivalent arrangements that are within the spirit and scope of the appended claims. For example, it is to be understood that the present technology contemplates that, to the extent possible, one or more features of any implementation can be combined with one or more features of any other implementation.