US 11,700,272 B2 · Threat actor identification systems and methods

Abstract

A threat actor identification system that obtains domain data for a set of domains, generates domain clusters, determines whether the domain clusters are associated with threat actors, and presents domain data for the clusters that are associated with threat actors to brand owners that are associated with the threat actors. The clusters may be generated based on similarities in web page content, domain registration information, and/or domain infrastructure information. For each cluster, a clustering engine determines whether the cluster is associated with a threat actor, and for clusters that are associated with threat actors, corresponding domain information is stored for presentation to brand owners to whom the threat actor poses a threat.

Claims18

Dependent claims

A threat actor identification system comprising:

a computer embodying a threat actor identification system, the computer comprising at least one processor and at least one non-transitory computer-readable medium storing instructions translatable by the at least one processor to perform:
obtaining domain data for each of a plurality of domains, wherein the domain data for each domain includes information identifying at least one corresponding brand owner;
generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains;
determining, for each of the generated domain clusters, whether the domain cluster is associated with a threat actor;
providing, for each of the generated domain clusters that is associated with a threat actor, an indication of the corresponding threat actor to one or more brand owners associated with corresponding domains in the domain cluster.

2 more elements

A method for identifying threat actors using domain data, the method comprising:

obtaining domain data for each of a plurality of domains, wherein the domain data for each domain includes information identifying at least one corresponding brand owner,
generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains;
determining, for each of the generated domain clusters, whether the domain cluster is associated with a threat actor;
providing, for each of the generated domain clusters that is associated with a threat actor, an indication of the corresponding threat actor to one or more one or more brand owners associated with corresponding domains in the domain cluster.

1 more element

A computer program product comprising at least one non-transitory computer-readable medium storing instructions translatable by at least one processor to perform:

obtaining domain data for each of a plurality of domains, wherein the domain data for each domain includes information identifying at least one corresponding brand owner;
generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains;
determining, for each of the generated domain clusters, whether the domain cluster is associated with a threat actor;
providing, for each of the generated domain clusters that is associated with a threat actor, an indication of the corresponding threat actor to one or more brand owners associated with corresponding domains in the domain cluster.

1 more element

Dependencies are inferred from the claim text.

Threat actor identification systems and methods

Life of this patent

Threat actor identification systems and methods

Life of this patent

Abstract

Claims18