Systems and methods for generating and utilizing lookalike uniform resource locators (URLs)
AssigneeZscaler, Inc.
InventorsHila Paz Herszfang, Dani Rubin, Eden Meyuhas, Roi Inbar, Samir Dabit
Life of this patent
Estimating the term…
Abstract
Systems and methods for generating and utilizing lookalike Uniform Resource Locators (URLs) include receiving an original target domain, the original target domain being associated with an enterprise; generating a plurality of lookalike domains via a genetic algorithm based on the original target domain and a plurality of deception methods; and utilizing the plurality of lookalike domains for performing one or more functions, wherein the one or more functions include providing a report and performing inline URL access filtering.
Claims20
A method comprising steps of:
- receiving an original target domain, the original target domain being associated with an enterprise;
- generating a plurality of lookalike domains based on the original target domain and a plurality of deception methods, the generating comprising:
- generating a first generation of lookalike domains, each domain in the first generation generated by applying exactly one deception method;
- computing a similarity score for each domain in the first generation based on a similarity to the original target domain;
- selecting a set of parent domains from the first generation based on their similarity scores exceeding a predetermined threshold;
- generating a subsequent generation of lookalike domains, each domain in the subsequent generation generated by combining deception methods from at least two selected parent domains;
- and
- iteratively repeating the selecting and generating steps to produce further generations until a termination condition is met;
- and
- utilizing the plurality of lookalike domains for performing one or more functions.
A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
- receiving an original target domain, the original target domain being associated with an enterprise;
- generating a plurality of lookalike domains based on the original target domain and a plurality of deception methods, the generating comprising:
- generating a first generation of lookalike domains, each domain in the first generation generated by applying exactly one deception method;
- computing a similarity score for each domain in the first generation based on a similarity to the original target domain;
- selecting a set of parent domains from the first generation based on their similarity scores exceeding a predetermined threshold;
- generating a subsequent generation of lookalike domains, each domain in the subsequent generation generated by combining deception methods from at least two selected parent domains;
- and
- iteratively repeating the selecting and generating steps to produce further generations until a termination condition is met;
- and
- utilizing the plurality of lookalike domains for performing one or more functions.
Dependencies are inferred from the claim text.