Similar domain detection using similarity check-based ranking
AssigneeZscaler, Inc.
InventorsRoee Gozlan, Shoham Danino
Life of this patent
Estimating the term…
Abstract
Systems and methods for similar domain detection include receiving a base domain, the base domain being associated with an enterprise; receiving a domain list comprising a plurality of domains; performing a plurality of similarity checks between the base domain and each of the plurality of domains within the domain list; and generating a directory of domains comprising one or more domains determined to be associated with the enterprise based on the one or more similarity checks.
Claims20
A method for performing similar domain detection, the method comprising steps of:
- receiving a base domain, the base domain being associated with an enterprise;
- receiving a domain list comprising a plurality of domains;
- performing a plurality of similarity checks between the base domain and each of the plurality of domains within the domain list, wherein performing the plurality of similarity checks comprises performing a content check that determines (i) domains that contain a full string of the base domain including a Top Level Domain (TLD) and (ii) domains that contain a domain-name portion of the base domain without the TLD, and performing one or more string-based similarity checks that compare a domain name portion of the base domain without the TLD to a domain-name portion of a respective domain without a TLD using a seq comparison that outputs a similarity ratio in a range of 0 to 1, and determining that the respective domain satisfies a corresponding similarity check when the similarity ratio exceeds a minimum ratio;
- and
- generating a directory of domains comprising one or more domains determined to be associated with the enterprise based on the one or more similarity checks and providing the directory of domains to a computing device associated with the enterprise.
A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
- receiving a base domain, the base domain being associated with an enterprise;
- receiving a domain list comprising a plurality of domains;
- performing a plurality of similarity checks between the base domain and each of the plurality of domains within the domain list, wherein performing the plurality of similarity checks comprises performing a content check that determines (i) domains that contain a full string of the base domain including a Top Level Domain (TLD) and (ii) domains that contain a domain-name portion of the base domain without the TLD, and performing one or more string-based similarity checks that compare a domain-name portion of the base domain without the TLD to a domain name portion of a respective domain without a TLD using a sequence comparison that outputs a similarity ratio in a range of 0 to 1, and determining that the respective domain satisfies a corresponding similarity check when the similarity ratio seeds a minimum ratio;
- and
- generating a directory of domains comprising one or more domains determined to be associated with the enterprise based on the one or more similarity checks and providing the directory of domains to a computing device associated with the enterprise.
Dependencies are inferred from the claim text.