# US 12,113,820 B2 · Threat actor identification systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,820 B2 - Document ID: US12113820B2 - Status: Granted - Kind: B2 - Application number: 18/201,448 - Filed: 2023-05-24 - Published: 2023-09-28 - Granted: 2024-10-08 - Earliest claimed: 2019-01-14 - Assignees: Proofpoint Technologies, Inc. - Applicants: Proofpoint, Inc. - Inventors: Gaurav Mitesh Dalal; Hung-Jen Chang; Ali Mesdaq - Web page: https://patentgrep.com/patent/US12113820B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 61/4511: using domain name system [DNS] - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A threat actor identification system that obtains domain data for a set of domains, generates domain clusters, determines whether the domain clusters are associated with threat actors, and presents domain data for the clusters that are associated with threat actors to brand owners that are associated with the threat actors. The clusters may be generated based on similarities in web page content, domain registration information, and/or domain infrastructure information. For each cluster, a clustering engine determines whether the cluster is associated with a threat actor, and for clusters that are associated with threat actors, corresponding domain information is stored for presentation to brand owners to whom the threat actor poses a threat. ## Claims ### Claim 1 A threat actor identification system comprising: a computer embodying a threat actor identification system, the computer comprising at least one processor and at least one non-transitory computer-readable medium storing instructions translatable by the at least one processor to perform: obtaining domain data for each of a plurality of domains; generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains, wherein the generating of the one or more domain clusters is based on an examination of the obtained domain data, which includes: examining web page content for the plurality of domains, determining web page content similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the web page content similarity values; and examining infrastructure data for the plurality of domains, determining infrastructure data similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the infrastructure data similarity values; determining, for one or more of the generated domain clusters, that the domain cluster is associated with a threat actor; and providing, for the one or more of the generated domain clusters that is associated with the threat actor, an indication of the corresponding threat actor to one or more corresponding entities targeted by the threat actor. ### Claim 2 (depends on 1) The system of claim 1, wherein the examination of the obtained domain data further includes examining domain registration data for the plurality of domains, determining domain registration data similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the domain registration data similarity values. ### Claim 3 (depends on 2) The system of claim 2, wherein the generating of the one or more domain clusters based on the examination of the obtained domain data comprises two separate clustering processes, wherein in a first, serial one of the clustering processes, the following are performed serially: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then domain registration data for remaining ones of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then infrastructure data for remaining ones of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors; wherein in a second, parallel one of the clustering processes, the following are performed in parallel: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, domain registration data for each of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, infrastructure data for each of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors. ### Claim 4 (depends on 1) The system of claim 1, wherein determining whether the domain cluster is associated with a threat actor comprises: if the domain cluster has more than a predetermined number of members, and one of the members has been registered within the last three months, and if phishing keywords are contained inside a domain name of one of the members or the domain name of one of the members has any associated threat activity, and if one of the members has HTTP status 200 or one of the members has one or more IP addresses or one of the members has an MX-record association, then the domain cluster is determined to be associated with a threat actor and is stored; otherwise, the domain cluster is determined not to be associated with a threat actor and is not stored. ### Claim 5 (depends on 1) The system of claim 1, wherein the one or more targeted entities associated with the threat actor are identified by: identifying the members of the domain cluster associated with the threat actor; identifying, for each of the members of the domain cluster, one or more targeted entities associated with the member. ### Claim 6 (depends on 1) The system of claim 1, wherein providing the indication of the threat actor to the one or more client devices of the one or more targeted entities associated with the threat actor comprises: for each of the one or more targeted entities associated with the threat actor, providing domain data for one or more of the members of the domain cluster associated with the threat actor, wherein the domain data includes one or more of: web page content of the member; domain registration data for the member; and infrastructure data for the member. ### Claim 7 A method for identifying threat actors using domain data, the method comprising: obtaining domain data for each of a plurality of domains; generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains, wherein the generating of the one or more domain clusters is based on an examination of the obtained domain data, which includes: examining web page content for the plurality of domains, determining web page content similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the web page content similarity values; and examining infrastructure data for the plurality of domains, determining infrastructure data similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the infrastructure data similarity values; determining, for one or more of the generated domain clusters, that the domain cluster is associated with a threat actor; and providing, for one or more of the generated domain clusters that is associated with the threat actor, an indication of the corresponding threat actor to one or more corresponding entities targeted by the threat actor. ### Claim 8 (depends on 7) The method of claim 7, wherein the examination of the obtained domain data further includes examining domain registration data for the plurality of domains, determining domain registration data similarity values indicative of similarities between individual ones of the plurality of domains, and domain clusters including ones of the plurality of domains are generated based on the domain registration data similarity values. ### Claim 9 (depends on 8) The method of claim 8, wherein the generating of the one or more domain clusters based on the examination of the obtained domain data comprises two separate clustering processes, wherein in a first, serial one of the clustering processes, the following are performed serially: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then domain registration data for remaining ones of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then infrastructure data for remaining ones of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors; wherein in a second, parallel one of the clustering processes, the following are performed in parallel: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, domain registration data for each of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, infrastructure data for each of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors. ### Claim 10 (depends on 7) The method of claim 7, wherein determining whether the domain cluster is associated with a threat actor comprises: if the domain cluster has more than a predetermined number of members, and one of the members has been registered within the last three months, and if phishing keywords are contained inside a domain name of one of the members or the domain name of one of the members has any associated threat activity, and if one of the members has HTTP status 200 or one of the members has one or more IP addresses or one of the members has an MX-record association then the domain cluster is determined to be associated with a threat actor and is stored; otherwise, the domain cluster is determined not to be associated with a threat actor and is not stored. ### Claim 11 (depends on 7) The method of claim 7, wherein the one or more targeted entities associated with the threat actor are identified by: identifying the members of the domain cluster associated with the threat actor; identifying, for each of the members of the domain cluster, one or more targeted entities associated with the member. ### Claim 12 (depends on 7) The method of claim 7, wherein providing the indication of the threat actor to the one or more client devices of the one or more targeted entities associated with the threat actor comprises: for each of the one or more targeted entities associated with the threat actor, providing domain data for one or more of the members of the domain cluster associated with the threat actor, wherein the domain data includes one or more of: web page content of the member; domain registration data for the member; and infrastructure data for the member. ### Claim 13 A computer program product comprising at least one non-transitory computer-readable medium storing instructions translatable by at least one processor to perform: obtaining domain data for each of a plurality of domains; generating, based on computed similarities in the obtained domain data, one or more domain clusters, each domain cluster including a corresponding subset of the plurality of domains, wherein the generating of the one or more domain clusters is based on an examination of the obtained domain data, which includes: examining web page content for the plurality of domains, determining web page content similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the web page content similarity values; and examining infrastructure data for the plurality of domains, determining infrastructure data similarity values indicative of similarities between individual ones of the plurality of domains, and generating domain clusters based on the infrastructure data similarity values; determining, for one or more of the generated domain clusters, that the domain cluster is associated with a threat actor; and providing, for one or more of the generated domain clusters that is associated with the threat actor, an indication of the corresponding threat actor to one or more corresponding entities targeted by the threat actor. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the examination of the obtained domain data further includes examining domain registration data for the plurality of domains, determining domain registration data similarity values indicative of similarities between individual ones of the plurality of domains, and domain clusters including ones of the plurality of domains are generated based on the domain registration data similarity values. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the generating of the one or more domain clusters based on the examination of the obtained domain data comprises two separate clustering processes, wherein in a first, serial one of the clustering processes, the following are performed serially: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then domain registration data for remaining ones of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, then infrastructure data for remaining ones of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors; wherein in a second, parallel one of the clustering processes, the following are performed in parallel: web page content for each of the plurality of domains is examined and domain clusters generated based on the web page content similarity values are forwarded to a clustering engine which determines whether the domain clusters are associated with corresponding threat actors, domain registration data for each of the plurality of domains are examined and domain clusters generated based on the domain registration data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors, infrastructure data for each of the plurality of domains are examined and domain clusters generated based on the infrastructure data similarity values are forwarded to the clustering engine which determines whether the domain clusters are associated with corresponding threat actors. ### Claim 16 (depends on 13) The computer program product of claim 13, wherein determining whether the domain cluster is associated with a threat actor comprises: if the domain cluster has more than a predetermined number of members, and one of the members has been registered within the last three months, and if phishing keywords are contained inside a domain name of one of the members or the domain name of one of the members has any associated threat activity, and if one of the members has HTTP status 200 or one of the members has one or more IP addresses or one of the members has an MX-record association then the domain cluster is determined to be associated with a threat actor and is stored; otherwise, the domain cluster is determined not to be associated with a threat actor and is not stored. ### Claim 17 (depends on 13) The computer program product of claim 13, wherein the one or more targeted entities associated with the threat actor are identified by: identifying the members of the domain cluster associated with the threat actor; identifying, for each of the members of the domain cluster, one or more targeted entities associated with the member. ### Claim 18 (depends on 13) The computer program product of claim 13, wherein providing the indication of the threat actor to the one or more client devices of the one or more targeted entities associated with the threat actor comprises: for each of the one or more targeted entities associated with the threat actor, providing domain data for one or more of the members of the domain cluster associated with the threat actor, wherein the domain data includes one or more of: web page content of the member; domain registration data for the member; and infrastructure data for the member.