Systems and methods for detecting online fraud
AssigneeBitdefender IPR Management Ltd.
InventorAlin O. Damian
Life of this patent
Estimating the term…
Abstract
Described systems and methods enable a swift and efficient detection of fraudulent Internet domains, i.e., domains used to host or distribute fraudulent electronic documents such as fraudulent webpages and electronic messages. Some embodiments use a reverse IP analysis to select a set of fraud candidates from among a set of domains hosted at the same IP address as a known fraudulent domain. The candidate set is further filtered according to domain registration data. Online content hosted at each filtered candidate domain is further analyzed to identify truly fraudulent domains. A security module may then prevent users from accessing a content of such domains.
Claims19
A computer system comprising at least one hardware processor configured to:
- in response to identifying a known fraudulent Internet domain located at an Internet Protocol (IP) address, select a candidate Internet domain according to whether the candidate Internet domain is located at the IP address;
- in response to selecting the candidate Internet domain, determine whether the candidate Internet domain satisfies a registration condition according to domain name registration data characterizing the candidate Internet domain;
- in response, when the candidate Internet domain satisfies the registration condition, analyze an electronic document distributed by the candidate Internet domain to determine whether the electronic document is fraudulent;
- in response to analyzing the electronic document, when the electronic document is fraudulent, determine that the candidate Internet domain is fraudulent;
- and
- in response to determining that the candidate Internet domain is fraudulent, transmit a fraud assessment indicator to another computer system, the fraud assessment indicator configured to cause the other computer system to block access to a resource hosted by the candidate Internet domain.
A computer-implemented method of identifying fraudulent Internet domains, the method comprising:
- in response to identifying a known fraudulent Internet domain located at an Internet Protocol (IP) address, employing at least one hardware processor of a computer system to select a candidate Internet domain according to whether the candidate Internet domain is located at the IP address;
- in response to selecting the candidate Internet domain, employing at least one hardware processor of the computer system to determine whether the candidate Internet domain satisfies a registration condition according to domain name registration data characterizing the candidate Internet domain;
- in response, when the candidate Internet domain satisfies the registration condition, employing at least one hardware processor of the computer system to analyze an electronic document distributed by the candidate Internet domain to determine whether the electronic document is fraudulent;
- in response to analyzing the electronic document, when the electronic document is fraudulent, employing at least one hardware processor of the computer system to determine that the candidate Internet domain is fraudulent;
- and
- in response to determining that the candidate Internet domain is fraudulent, employing at least one hardware processor of the computer system to transmit a fraud assessment indicator to another computer system, the fraud assessment indicator configured to cause the other computer system to block access to a resource hosted by the candidate Internet domain.
A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the at least one hardware processor to perform the steps of:
- in response to identifying a known fraudulent Internet domain located at an Internet Protocol (IP) address, selecting a candidate Internet domain according to whether the candidate Internet domain is located at the IP address;
- in response to selecting the candidate Internet domain, determining whether the candidate Internet domain satisfies a registration condition according to domain name registration data characterizing the candidate Internet domain;
- in response, when the candidate Internet domain satisfies the registration condition, analyzing an electronic document distributed by the candidate Internet domain to determine whether the electronic document is fraudulent;
- in response to analyzing the electronic document, when the electronic document is fraudulent, determining that the candidate Internet domain is fraudulent;
- and
- in response to determining that the candidate Internet domain is fraudulent, transmitting a fraud assessment indicator to another computer system, the fraud assessment indicator configured to cause the other computer system to block access to a resource hosted by the candidate Internet domain.
Dependencies are inferred from the claim text.