# US 12,192,230 B2 · Domain reputation system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,230 B2 - Document ID: US12192230B2 - Status: Granted - Kind: B2 - Application number: 17/387,717 - Filed: 2021-07-28 - Published: 2022-02-03 - Granted: 2025-01-07 - Earliest claimed: 2020-07-28 - Assignees: Cequence Security, Inc. - Applicants: Cequence Security, Inc. - Inventors: Will Glazier; Khyati Ganatra; Shaunak Kapoor - Web page: https://patentgrep.com/patent/US12192230B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques to facilitate domain reputation analysis and prevention of malicious attacks on a web service are disclosed herein. In at least one implementation, web resources associated with the web service are crawled to obtain information about internal and external web assets associated with the web service. The information about the internal and external web assets is processed to identify domains with which the internal and external web assets communicate. The domains are analyzed to determine name server reputation, internet protocol (IP) address reputation, and hosting provider reputation associated with the domains. Individual domain reputation scores for each of the domains are generated based on the name server reputation, IP address reputation, and hosting provider reputation associated with the domains. ## Claims ### Claim 1 A method to facilitate domain reputation analysis and prevention of malicious attacks on a web service, the method comprising: crawling web resources associated with the web service to obtain information about internal and external web assets associated with the web service; utilizing headless browser automation with a security scanner browser extension to intercept responses from the internal and external web assets based on the obtained information; dynamically injecting content security policy headers into the responses to determine dependency data associated with the internal and external web assets; identifying the domains with which the internal and external web assets communicate based on the dependency data; analyzing the domains to determine name server reputation, internet protocol (IP) address reputation, and hosting provider reputation associated with the domains; generating individual domain reputation scores for each of the domains based on the name server reputation, IP address reputation, and hosting provider reputation associated with the domains; and dynamically generating and deploying content security policies for the web service based on the individual domain reputation scores for each of the domains to protect the web service. ### Claim 2 (depends on 1) The method of claim 1 wherein crawling the web resources associated with the web service to obtain the information about the internal and external web assets associated with the web service comprises utilizing a scalable system of crawlers to passively scan the web resources and any associated Uniform Resource Identifiers (URIs) to obtain the information about the internal and external web assets associated with the web service. ### Claim 3 (depends on 1) The method of claim 1 wherein analyzing the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains comprises analyzing domain registration information associated with the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains. ### Claim 4 (depends on 1) The method of claim 1 wherein analyzing the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains comprises analyzing whether any name servers, IP addresses, or hosting providers associated with the domains were previously associated with malicious attacks. ### Claim 5 (depends on 1) The method of claim 1 wherein analyzing the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains comprises analyzing whether any name servers, IP addresses, or hosting providers associated with the domains were previously involved in hosting illegitimate activities. ### Claim 6 (depends on 1) The method of claim 1 wherein generating the individual domain reputation scores for each of the domains based on the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains comprises performing graph analysis on relationships between the internal and external web assets and generating the individual domain reputation scores for each of the domains based on the graph analysis. ### Claim 7 (depends on 1) The method of claim 1 wherein deploying the content security policies for the web service comprises deploying the content security policies via a Content Delivery Network (CDN). ### Claim 8 An apparatus to facilitate domain reputation analysis and prevention of malicious attacks on a web service, the apparatus comprising: one or more computer-readable storage media; a processing system operatively coupled with the one or more computer-readable storage media; and program instructions stored on the one or more computer-readable storage media that, when executed by the processing system, direct the processing system to at least: crawl web resources associated with the web service to obtain information about internal and external web assets associated with the web service; utilize headless browser automation with a security scanner browser extension to intercept responses from the internal and external web assets based on the obtained information; dynamically inject content security policy headers into the responses to determine dependency data associated with the internal and external web assets; process the dependency data associated with the internal and external web assets to identify domains with which the internal and external web assets communicate; analyze the domains to determine name server reputation, internet protocol (IP) address reputation, and hosting provider reputation associated with the domains; generate individual domain reputation scores for each of the domains based on the name server reputation, IP address reputation, and hosting provider reputation associated with the domains; and dynamically generate and deploy content security policies for the web service based on the individual domain reputation scores for each of the domains to protect the web service. ### Claim 9 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system utilize a scalable system of crawlers to passively scan the web resources and any associated Uniform Resource Identifiers (URIs) to obtain the information about the internal and external web assets associated with the web service. ### Claim 10 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the processing system to analyze domain registration information associated with the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains. ### Claim 11 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the processing system to analyze whether any name servers, IP addresses, or hosting providers associated with the domains were previously associated with malicious attacks. ### Claim 12 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the processing system to analyze whether any name servers, IP addresses, or hosting providers associated with the domains were previously involved in hosting illegitimate activities. ### Claim 13 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system to generate the individual domain reputation scores for each of the domains based on the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the processing system to perform graph analysis on relationships between the internal and external web assets and generate the individual domain reputation scores for each of the domains based on the graph analysis. ### Claim 14 (depends on 8) The apparatus of claim 8 wherein the program instructions direct the processing system to dynamically deploy the content security policies via a Content Delivery Network (CDN). ### Claim 15 One or more computer-readable storage media having program instructions stored thereon to facilitate domain reputation analysis and prevention of malicious attacks on a web service, wherein the program instructions, when executed by a computing system, direct the computing system to at least: crawl web resources associated with the web service to obtain information about internal and external web assets associated with the web service; utilize headless browser automation with a security scanner browser extension to intercept responses from the internal and external web assets based on the obtained information; dynamically inject content security policy headers into the responses to determine dependency data associated with the internal and external web assets; process the dependency data associated with the internal and external web assets to identify domains with which the internal and external web assets communicate; analyze the domains to determine name server reputation, internet protocol (IP) address reputation, and hosting provider reputation associated with the domains; generate individual domain reputation scores for each of the domains based on the name server reputation, IP address reputation, and hosting provider reputation associated with the domains; and dynamically generate and deploy content security policies for the web service based on the individual domain reputation scores for each of the domains to protect the web service. ### Claim 16 (depends on 15) The one or more computer-readable storage media of claim 15 wherein the program instructions direct the computing system to utilize a scalable system of crawlers to passively scan the web resources and any associated Uniform Resource Identifiers (URIs) to obtain the information about the internal and external web assets associated with the web service. ### Claim 17 (depends on 15) The one or more computer-readable storage media of claim 15 wherein the program instructions direct the computing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the computing system to analyze domain registration information associated with the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains. ### Claim 18 (depends on 15) The one or more computer-readable storage media of claim 15 wherein the program instructions direct the computing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the computing system to analyze whether any name servers, IP addresses, or hosting providers associated with the domains were previously associated with malicious attacks. ### Claim 19 (depends on 15) The one or more computer-readable storage media of claim 15 wherein the program instructions direct the computing system to analyze the domains to determine the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the computing system to analyze whether any name servers, IP addresses, or hosting providers associated with the domains were previously involved in hosting illegitimate activities. ### Claim 20 (depends on 15) The one or more computer-readable storage media of claim 15 wherein the program instructions direct the computing system to generate the individual domain reputation scores for each of the domains based on the name server reputation, the IP address reputation, and the hosting provider reputation associated with the domains by directing the computing system to perform graph analysis on relationships between the internal and external web assets and generate the individual domain reputation scores for each of the domains based on the graph analysis.