Improving network security through real-time analysis of character similarities
AssigneeCyberArk Software Ltd.
InventorOfer Rivlin
Life of this patent
Estimating the term…
Abstract
Disclosed embodiments relate to improving network security through real-time analysis of character similarities. Techniques include identifying a reference name, identifying a domain name, and performing a real-time analysis of the domain name. The real-time analysis may include applying a language processing protocol to the domain name, generating a score indicating a similarity between the domain name and the reference name, accessing a similarity threshold, and comparing the generated score with the similarity threshold. Further techniques include determining that the score exceeds the threshold and performing a security action.
Claims18
A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for analyzing domain names to detect potential security risks, the operations comprising:
- identifying a reference name;
- identifying a domain name;
- performing a real time analysis of the domain name, the analysis comprising:
- applying a language processing protocol to the domain name, wherein the domain name is an input to the application of the language processing protocol and the language processing protocol is a word embedding algorithm for separating the domain name into two or more subparts, wherein each of the two or more subparts comprises at least one character;
- calculating, for each of the at least two subparts, a first score using term frequency inverse document frequency;
- creating vectors associated with the word embedding algorithm for the domain name based on the first score for each of the at least two subparts;
- generating, based on the domain name, the vectors, the first score, and the application of the language processing protocol, a second score indicating a similarity between the domain name and the reference name;
- accessing a similarity threshold;
- and
- comparing the second score with the similarity threshold;
- determining, based on the comparison, that the second score exceeds the threshold;
- and
- performing, based on the determination, a security action corresponding to the domain name, the security action comprising at least one of:
- sending an alert indicating the domain name is potentially malicious;
- displaying a visual notation associated with the domain name;
- blocking access to the domain name;
- preventing an email from being sent to an email address associated with the domain name;
- or
- preventing an email from being received from an email address associated with the domain name.
The non-transitory computer readable medium, wherein the second score is a confidence score indicating a level of variation of the domain name from the reference name.
A computer implemented method for analyzing character elements to detect potential security risks, the method comprising:
- identifying a reference name;
- identifying a character element;
- performing a real time analysis of the character element, the analysis comprising:
- applying a language processing protocol to the character element wherein the character element is an input to the application of the language processing protocol and the language processing protocol is a word embedding algorithm comprising separating the character element into two or more subparts, wherein each of the two or more subparts comprises at least one character;
- calculating, for each of the at least two subparts, a first score using term frequency inverse document frequency;
- creating vectors associated with the word embedding algorithm for the character element based on the first score of each of the at least two subparts;
- generating, based on the character element, the vectors, the first score, and the application of the language processing protocol, a second score indicating a similarity between the character element and the reference name;
- accessing a similarity threshold;
- and
- comparing the second score with the similarity threshold;
- determining, based on the comparison, that the second score exceeds the threshold;
- and
- performing, based on the determination, a security action corresponding to the character element.
Dependencies are inferred from the claim text.