Back to results
US 11,973,800 B2Granted
Domain squatting detection
AssigneePalo Alto Networks, Inc.
InventorsZhanhao Chen, Jun Wang, Daiping Liu
Life of this patent
Estimating the term…
Abstract
Detection of squatting domains is disclosed. A set of new fully qualified domain names (FQDNs) is received. The set of new FQDNs is analyzed to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains. The candidate squatting domains are distributed to a security device/service.
Claims9
A system, comprising:
- a processor configured to:
- receive a set of new fully qualified domain names (FQDNs), comprising to:
- receive one or more of the following:
- a set of newly registered domains (NRDs) or a set of newly observed hostnames (NOHs);
- analyze the set of new FQDNs to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains, comprising to:
- perform one or more of the following:
- A) cluster the set of NRDs into lexically similar groups to obtain a plurality of NRD clusters, comprising to:
- determine lexical characteristics of the set of NRDs;
- vector, based on the lexical characteristics, domain names of the set of NRDs using bi-gram term frequency-inverse document frequency (TF-IDF);
- and
- group the vectorized domain names into clusters using density based spatial clustering of applications with noise (DBSCAN);
- calculate distances from potential target domains to the plurality of NRD clusters;
- and
- identify a subset of NRDs having the closest distance to the potential target domains as candidate typosquatting domains;
- or
- B) split an NOH of the set of NOHs into a plurality of first segments, wherein one first segment is separated from another first segment by a period or a dash;
- split a potential target domain into a plurality of second segments, wherein one second segments is separated from another second segment by a period or a dash;
- compare one first segment of the plurality of first segments with one second segment of the plurality of second segments;
- and
- in response to a determination that the one first segment matches the one second segment, determine that the NOH is a candidate levelsquatting domain;
- and
- distribute the candidate squatting domains to a security device/service;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
21 more elements
A method, comprising:
- receiving, using a processor, a set of new fully qualified domain names (FQDNs);
- analyzing, using the processor, the set of new FQDNs to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains, comprising:
- performing one or more of the following:
- A) clustering the set of NRDs into lexically similar groups to obtain a plurality of NRD clusters, comprising:
- determining lexical characteristics of the set of NRDs;
- vectoring, based on the lexical characteristics, domain names of the set of NRDs using bi-gram term frequency-inverse document frequency (TF-IDF);
- and
- grouping the vectorized domain names into clusters using density based spatial clustering of applications with noise (DBSCAN);
- calculating distances from potential target domains to the plurality of NRD clusters;
- and
- identifying a subset of NRDs having the closest distance to the potential target domains as candidate typosquatting domains;
- or
- B) splitting an NOH of the set of NOHs into a plurality of first segments, wherein one first segment is separated from another first segment by a period or a dash;
- splitting a potential target domain into a plurality of second segments,
- wherein one second segments is separated from another second segment by a period or a dash;
- comparing one first segment of the plurality of first segments with one second segment of the plurality of second segments;
- and
- in response to a determination that the one first segment matches the one second segment, determining that the NOH is a candidate levelsquatting domain;
- and
- distributing, using the processor, the candidate squatting domains to a security device/service.
17 more elements
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving a set of new fully qualified domain names (FQDNs);
- analyzing the set of new FQDNs to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains, comprising:
- performing one or more of the following:
- A) clustering the set of NRDs into lexically similar groups to obtain a plurality of NRD clusters, comprising:
- determining lexical characteristics of the set of NRDs;
- vectoring, based on the lexical characteristics, domain names of the set of NRDs using bi-gram term frequency-inverse document frequency (TF-IDF);
- and
- grouping the vectorized domain names into clusters using density based spatial clustering of applications with noise (DBSCAN);
- calculating distances from potential target domains to the plurality of NRD clusters;
- and
- identifying a subset of NRDs having the closest distance to the potential target domains as candidate typosquatting domains;
- or
- B) splitting an NOH of the set of NOHs into a plurality of first segments, wherein one first segment is separated from another first segment by a period or a dash;
- splitting a potential target domain into a plurality of second segments, wherein one second segments is separated from another second segment by a period or a dash;
- comparing one first segment of the plurality of first segments with one second segment of the plurality of second segments;
- and
- in response to a determination that the one first segment matches the one second segment, determining that the NOH is a candidate levelsquatting domain;
- and
- distributing the candidate squatting domains to a security device/service.
16 more elements
Dependencies are inferred from the claim text.