Domain clustering for malicious campaign identification

A system, comprising:

• one or more processors;
• and
• a computer-readable storage medium, coupled to the one or more processors, storing program instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• extracting a set of domain information from a plurality of input streams, the set of domain information including a set of domains and a set of domain characteristics describing each domain, the plurality of input streams includes a first input stream of one or more domain registrars representing newly registered domains and a set of second input streams of one or more non-domain registrar sources containing domain information;
• generating enriched domain information by correlating the set of domain information from the first input stream and the set of second input streams, the enriched domain information inserting missing data into domain information of a specified input stream from another input stream of the plurality of input streams;
• based on the set of domain characteristics and the enriched domain information, clustering the set of domains to generate a set of campaign clusters of related domains, one or more campaign clusters including one or more new domains and at least one known domain, each campaign cluster including domains identified as belonging to a single campaign, wherein clustering the set of domains is iterative to reduce a number of related domains in one of the campaign clusters to be at or below a threshold size such that the related domains share a lowest level relationship;
• modifying the set of campaign clusters with a set of threat intelligence ratings to generate a set of enriched campaign clusters, a portion of the set of threat intelligence ratings corresponding to one or more domains within the set of campaign clusters;
• determining a cluster designation for each campaign cluster of the set of enriched campaign clusters;
• and
• distributing the cluster designations for each campaign cluster to one or more threat intelligence resource.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by one or more processors to cause the one or more processors to perform operations comprising:

• extracting a set of domain information from a plurality of input streams, the set of domain information including a set of domains and a set of domain characteristics describing each domain, the plurality of input streams includes a first input stream of one or more domain registrars representing newly registered domains and a set of second input streams of one or more non-domain registrar sources containing domain information;
• generating enriched domain information by correlating the set of domain information from the first input stream and the set of second input streams, the enriched domain information inserting missing data into domain information of a specified input stream from another input stream of the plurality of input streams;
• based on the set of domain characteristics and the enriched domain information, clustering the set of domains to generate a set of campaign clusters of related domains, one or more campaign clusters including one or more new domains and at least one known domain, each campaign cluster including domains identified as belonging to a single campaign, wherein clustering the set of domains is iterative to reduce a number of related domains in one of the campaign clusters to be at or below a threshold size such that the related domains share a lowest level relationship;
• modifying the set of campaign clusters with a set of threat intelligence ratings to generate a set of enriched campaign clusters, a portion of the set of threat intelligence ratings corresponding to one or more domains within the set of campaign clusters;
• determining a cluster designation for each campaign cluster of the set of enriched campaign clusters;
• and
• distributing the cluster designations for each campaign cluster to one or more threat intelligence resource.