Back to results
US 10,382,469 B2Granted
Domain age registration alert
AssigneeRapid7, Inc.
InventorsSamuel Adams, H D Moore
Life of this patent
Estimating the term…
Abstract
Systems and methods of identifying a security risk by monitoring and generating alerts based on attempts to access web domains that have been registered within a short period of time and are therefore identified as “high-risk,” including identifying an attempt to access a domain; receiving a registration date of the domain; and detecting a security risk based on the registration date of the domain.
Claims16
A method for identifying a network security risk, the method comprising:
- generating, using a web filter, a web activity log comprising at least one domain that is the subject of a request via the internet for information and an access date associated with the request, wherein the request is made by a pseudo account created with credentials that are not assigned to a user and stored in a database of known pseudo accounts and known accounts of authorized users, wherein the pseudo account is an account that has been inactive for a determined threshold period of time or an account that has been marked for deletion;
- requesting domain age data for the at least one domain using a router device;
- receiving a registration date of the at least one domain from a database module;
- identifying, using a management console, a domain in the web activity log as a security risk based on the time lapsed between the access date associated with the request for the identified domain and the registration date of the domain being less than a predetermined threshold and based on the request being made by the pseudo account created with credentials that are not assigned to a user;
- and
- restricting access to the domain identified as a security risk using the web filter based on the time lapsed between the access date associated with the request for the identified domain and the registration date of the domain being less than a predetermined threshold and based on the request being made by the pseudo account created with credentials that are not assigned to a user;
- and
- communicating data regarding the pseudo account activity to an account mapping system configured to track pseudo account activity to an account of an authorized user, wherein the account mapping system is in communication with the database of known pseudo accounts and known accounts of authorized users;
- tracking the activity associated with the pseudo account to an account of an authorized user;
- and
- performing at least one of:
- implementing a security policy update based on the pseudo account being tracked to the account of an authorized user, and
- enforcing a security policy based on the pseudo account being tracked to the account of an authorized user.
10 more elements
A system for identifying a security risk, the system comprising:
- one or more computer readable storage media configured as a database module of registration information for a plurality of domains;
- one or more hardware processors coupled with the one or more computer readable storage media;
- and
- program instructions stored on the one or more computer readable storage media that, when read and executed by the one or more hardware processors, direct the system to implement:
- a web filter configured to generate a web activity log comprising at least one domain that is the subject of a request via the internet for information and an access date associated with the request, wherein the request is made by a pseudo account created with credentials that are not assigned to a user and stored in a database of known pseudo accounts and known accounts of authorized users, wherein the pseudo account is an account that has been inactive for a threshold period of time or an account that has been marked for deletion;
- and
- a management console configured to, retrieve a registration date of at least one domain in the web activity log from the database module, and identify a domain in the web activity log as a security risk based on the time lapsed between the access date associated with the identified domain and the registration date of the domain being less than a predetermined threshold and based on the request being made by the pseudo account created with credentials that are not assigned to a user,
- wherein the web filter is further configured to restrict access to the domain identified as a security risk using the web filter based on the time lapsed between the access date associated with the request for the identified domain and the registration date of the domain being less than a predetermined threshold and based on the request being made by the pseudo account created with credentials that are not assigned to a user;
- and
- an account mapping system in communication with the database of known pseudo accounts and known accounts of authorized users and configured to:
- track pseudo account activity to an account of an authorized user,
- track the activity associated with the pseudo account to an account of an authorized user, and
- perform at least one of:
- implementing a security policy update based on the pseudo account being tracked to the account of an authorized user, and enforcing a security policy based on the pseudo account being tracked to the account of an authorized user.
11 more elements
Dependencies are inferred from the claim text.