Back to results
US 11,902,324 B2Granted
System and methods for spoofed domain identification and user training
AssigneeKnowBe4, Inc.
InventorsStu Sjouwerman, Alin Irimie, Greg Kras
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed that minimize ongoing risk to an organization from user behaviors which magnify the severity of a spoofed domain. Systems and method are provided which enable an entity and users of an entity to identify potential harmful domains, combining search, discovery, reporting, the generation of risk indicators, end-user risk assessments, and training into a security awareness system.
Claims16
A method comprising:
- identifying, by one or more processors, via mail exchange records of each of a plurality of uniform resource locators (URLs) of a plurality of spoofed domains of a domain name of an entity, a first one or more spoofed domains of the plurality of spoofed domains of the entity are registered to one or more parties other than the entity and a second one or more spoofed domains of the plurality of spoofed domains of the entity are unregistered;
- determining, by the one or more processors, a level of spoof risk for the domain name of the entity based at least on a number of the first one or more spoofed domains that are registered to one or more parties other than the entity in comparison to a number of the plurality of spoofed domains, wherein the level of spoof risk for the domain name is higher when the number of the first one or more spoofed domains of the plurality of spoofed domains of the entity is greater than the number of the second one or more spoofed domains of the plurality of spoofed domains of the entity;
- identifying, by the one or more processors based at least on the level of spoof risk, the second one or more spoofed domains of the plurality of spoofed domains of the entity that are unregistered;
- and
- generating a notification that the second one or more spoofed domains are available to be registered to the entity.
2 more elements
A system comprising:
- one or more processors, coupled to memory, and configured to:
- identify, via mail exchange records of each of a plurality of uniform resource locators (URLs) of a plurality of spoofed domains of a domain name of an entity, a first one or more spoofed domains of the plurality of spoofed domains of the entity are registered to one or more parties other than the entity and a second one or more spoofed domains of the plurality of spoofed domains of the entity are unregistered;
- determine a level of spoof risk for the domain name of the entity based at least on a number of the first one or more spoofed domains that are registered to one or more parties other than the entity in comparison to a number of the plurality of spoofed domains, wherein the level of spoof risk for the domain name is higher when the number of the first one or more spoofed domains of the plurality of spoofed domains of the entity is greater than the number of the second one or more spoofed domains of the plurality of spoofed domains of the entity;
- identify, based at least on the level of spoof risk, the second one or more spoofed domains of the plurality of spoofed domains of the entity that are unregistered;
- and
- generate a notification that the second one or more spoofed domains are available to be registered to the entity.
3 more elements
Dependencies are inferred from the claim text.