Identifying legitimate websites to remove false positives from domain discovery analysis

#Aspects of the disclosure relate to digital data processing systems, data processing methods, machine learning systems, and communication systems and networks. In particular, one or more aspects of the disclosure relate to identifying legitimate websites to remove false positives from domain discovery analysis.

#Increasingly, organizations face various cybersecurity threats from malicious domains. Various methods of domain analysis have been developed to combat these threats. It remains difficult, however, to identify domains that pose an actual threat to these organizations due to an often high likelihood of false positive domain identification. This is particularly true for organizations with common word seed domains, as analysis of these common word seed domains results in a significant number of domain matches. Furthermore, it remains challenging to identify whether an organization operating a specific domain is legitimate based only on the name of the specific domain. These issues present even greater challenges when automated processes are executed to analyze large numbers of domains, particularly when also trying to balance and optimize consumption of the computing resources required for such analysis, such as processing power and network bandwidth.

#Aspects of the disclosure provide technical solutions that overcome one or more of the technical problems described above and/or other technical challenges. For instance, one or more aspects of the disclosure relate to identifying legitimate websites and removing false positives from domain discovery analysis.

#The present disclosure is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:

#FIG. 1 depicts an illustrative operating environment for identifying legitimate websites and removing false positives from domain discovery analysis in accordance with one or more example embodiments;

#FIGS. 2A-2O depict an illustrative event sequence for identifying legitimate websites and removing false positives from domain discovery analysis in accordance with one or more example embodiments;

#In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the present disclosure. Various connections between elements are discussed in the following description. It is noted that these connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless, and that the specification is not intended to be limiting in this respect.

#Some aspects of the disclosure relate to identifying legitimate websites and removing false positives from domain discovery analysis. For example, in a domain discovery analysis process, variations of a specific entity's domain names may be identified and monitored so as to alert the entity (who may, e.g., be a customer of and/or subscriber to a domain discovery monitoring service) about potentially infringing domains, phishing attempts, and/or other malicious sites. In some instances, however, if the entity (e.g., the customer) has a common English word seed domain or part of a common English word in their domain name, there may be many domain matches for the entity's domain(s) during the domain discovery analysis process. Where many matches are determined for a given seed, it may become difficult for the entity (e.g., the customer) to filter down the matches to a set that includes only the domain names that are an actual threat to the entity's seed domain. To reduce a number of non-relevant results and thereby address these issues and/or other issues, one or more aspects of the disclosure provide systems and methods for identifying domain names that (1) match a specific entity's domain seed and (2) are registered by a legitimate business or other organization, so as to classify these identified domain names as false positives and remove them from a set of potentially-malicious domain names that may be subject to enhanced scrutiny.

#This disclosure provides a multi-part analysis that may be employed to classify a domain (which may, in some instances, be identified as a variant of a domain name being monitored) as either legitimate or indeterminate. If a domain is classified as legitimate, this classification may indicate that the domain is owned and/or operated by a legitimate organization and has a legitimate purpose for being similar to the domain name being monitored (which may, e.g., correspond to a specific entity's domain name(s), such as a customer's domain name(s)). Alternatively, if a domain is classified as indeterminate, this classification may indicate that the domain might not be owned and/or operated by a legitimate business and/or might not have a legitimate purpose for being similar to the domain name being monitored. In these instances, further investigation of the domain, a takedown request, or other action may be initiated.