# US 2018/0027013 A1 · Methods for preventing cyber intrusions and phishing activity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027013 A1 - Document ID: US20180027013A1 - Status: Published application - Kind: A1 - Application number: 15/648,361 - Filed: 2017-07-12 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Duo Security, Inc. - Applicants: Duo Security, Inc. - Inventors: Jordan Wright; Jon Oberheide - Web page: https://patentgrep.com/patent/US20180027013A1 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 16/951: Indexing; Web crawling techniques - G06F 16/953: Querying, e.g. by the use of web search engines - H04L 61/301: Name conversion - H04L 61/4511: using domain name system [DNS] - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for mitigating cyber intrusions includes: receiving target domain input, wherein the target domain input comprises a domain name associated with a target entity or target entity data that is useable to generate phishing attack domain names; using the target domain name input to generate the phishing attack domain names, wherein the phishing attack domain names include a plurality of domain names each having a phishing value comprising a likelihood or a probability of being used in a phishing campaign against the digital resources, where the likelihood or the probability satisfies a predetermined phishing value threshold; arranging the phishing attack domain names in a hierarchical order; and implementing one or more digital resources security protocols that mitigates the likelihood or the probability that selected domain names of the phishing attack domain names may be used in the phishing campaign against the digital resources. ## Claims ### Claim 1 A system for mitigating attacks on a computer network, the system comprising: a web interface configured to receive target domain name input; a remote computing server that is configured to generate phishing domain names and that: receives the target domain input, wherein the target domain input comprises a domain name associated with a target entity or target entity data that is useable to generate a plurality of phishing attack domain names; uses the target domain name input to generate a plurality of phishing attack domain names, wherein the plurality of phishing attack domain names include a plurality of domain names having a likelihood or a probability of being used in a phishing campaign against the computer network, the likelihood or the probability exceeding a predetermined phishing value threshold; in response to generating the plurality of phishing attack domain names, arranges the plurality of phishing attack domain names in a hierarchical order; and implements one or more computer security protocols that mitigates the likelihood or the probability that selected domain names of the plurality of phishing attack domain names may be used in the phishing campaign against the computer network. ### Claim 2 (depends on 1) The system of claim 1, wherein the remote computing server is further configured to generate visual similarity scores for the plurality of phishing attack domain names, wherein generating the visual similarity scores includes: comparing each of the plurality of phishing attack domain names to the domain name of the target entity; using the comparison to calculate the visual similarity score for each of the plurality of phishing attack domain names, wherein the visual similarity score indicates a level of resemblance between the target domain name and a phishing attack domain name of the plurality of phishing attack domain names generated by the system; using the visual similarity to rank the plurality of phishing attack domain names with respect to each other; wherein the remote computing server further implements the one or more computer security protocols by (i) automatically selecting a portion of the plurality of phishing attack domain names based on the visual similarity scores and (ii) restricting a capability of a malicious actor to use the portion of the plurality of phishing attack domain names in the phishing campaign. ### Claim 3 (depends on 1) The system of claim 1, wherein the remote computing server is further: ranks each of the plurality of phishing attack domain names based on calculated fit scores, wherein the fit scores indicate a generated probability or a likelihood of successfully implementing a phishing attack on the target computer network using one of the plurality of phishing attach domain names; automatically selects at least a phishing attack domain name of the plurality of phishing attach domain names having a highest rank; and implements one or more computer security protocols based on the selection. ### Claim 4 (depends on 3) The system of claim 3, wherein implementing the one or more computer security protocols includes implementing a digital lockdown of the plurality of phishing attack domain names, wherein the digital lockdown includes restricting digital access and use of the plurality of phishing attack domain names by entities other than the target entity. ### Claim 5 A method for preventing a cyber intrusion of digital resources of a target entity, the method comprising: at a web computing server: receiving target domain input, wherein the target domain input comprises a domain name associated with a target entity or target entity data that is useable to generate a plurality of phishing attack domain names; using the target domain name input to generate the plurality of phishing attack domain names, wherein the plurality of phishing attack domain names include a plurality of domain names each having a phishing value comprising a likelihood or a probability of being used in a phishing campaign against the digital resources, where the likelihood or the probability satisfies a predetermined phishing value threshold; in response to generating the plurality of phishing attack domain names, arranging the plurality of phishing attack domain names in a hierarchical order; and implementing one or more digital resources security protocols that mitigates the likelihood or the probability that selected domain names of the plurality of phishing attack domain names may be used in the phishing campaign against the digital resources. ### Claim 6 (depends on 5) The method of claim 5, wherein the phishing value indicates a determine likelihood or a determined probability of successfully implementing a phishing attack on one or more digital resources of the target entity using a phishing attack domain name. ### Claim 7 (depends on 5) The method of claim 5, wherein the predetermined phishing value threshold defines a minimum likelihood or a minimum probability of successfully implementing a phishing attack on one or more digital resources. ### Claim 8 (depends on 7) The method of claim 7, wherein any of the plurality of phishing attack domain names having the likelihood or the probability of successfully being used in the phishing campaign that satisfies or exceeds the predetermined phishing value is automatically populated to a list or a table of phishing domain name candidates, and wherein any of the plurality of phishing attack domain names having the likelihood or the probability of successfully being used in the phishing campaign that does not satisfy or exceed the predetermined phishing value is not included in the list or the table of phishing domain name candidates ### Claim 9 (depends on 5) The method of claim 5, at the web server further comprising: identifying phishing attack domain name generation parameters, wherein the phishing attack domain name parameters include one or more of an amount of attack domain names to be generated, a selection of one or more types of domain name modification operations to be performed in the generating the phishing attack domain names, a number of iterations of generated attack domain names, and an identification of one or more phishing attack domain name generation input data sources. ### Claim 10 (depends on 9) The method of claim 9, at the web server further comprising: applying the one or more types of domain name modification operations that are statistically common statistically common domain name variation types used by cyber attackers. ### Claim 10 (depends on 5) The method of claim 5, wherein further at the web computing server: determining whether a selection of the plurality of phishing attack domain names are available for registration; and automatically registering the selection of the plurality of phishing attack domain names when it is determined that they are available for registration. ### Claim 11 (depends on 5) The method of claim 5, wherein further at the web computing server: using the target domain name input to identify additional target entity data relating to the target entity; and in response to identifying the additional target entity data, collecting the additional target entity data to be used as input in generating the plurality of phishing attack domain names. ### Claim 11 (depends on 5) The method of claim 5, wherein implementing the one or more digital resources security protocols includes monitoring digital activities associated with the plurality of phishing attack domain names, wherein monitoring includes tracking DNS lookups for each of the plurality of phishing attack domain names. ### Claim 12 (depends on 5) The method of claim 5, wherein implementing the one or more digital resources security protocols includes implementing a digital lockdown of the plurality of phishing attack domain names, wherein the digital lockdown includes restricting digital access and use of the plurality of phishing attack domain names by entities other than the target entity ### Claim 13 (depends on 5) The method of claim 5, further comprises configuring the web computing server to: rank each of the plurality of phishing attack domain names based the phishing value of the respective phishing attack domain name; automatically select one or more of the plurality of phishing attack domain names; and wherein implementing the one or more digital resources security protocols is implemented for the selected one or more of the plurality of phishing attack domain names. ### Claim 14 (depends on 5) The method of claim 5, further comprising configuring the sever to perform modification operations to the target domain name by one or a combination of homoglyphic modification, bitsquatting modification, omission modification, replacement modification, transposition modification, singularizing, pluralization, punctuation modification, and appending modification. ### Claim 15 (depends on 5) The method of claim 5, wherein the plurality of phishing attack domain names are look-alike domain names with respect to the target domain name, such that when the plurality of phishing attack domain names are compared to the target domain name, there are visual similarities between each of the plurality of phishing attack domain names and the target domain name. ### Claim 16 (depends on 15) The method of claim 15, wherein the plurality of phishing attack domain names are generated according to a selection of one or of a combination of domain name transformation processes including a homoglyph transformation process, a TLD alternation/modification process, generic or service-specific prefix/suffix augmentation process, character repositioning and spacing, character transposition process, and character deletion process. ### Claim 17 (depends on 1) The system of claim 1, further comprising: a pseudo domain name database, the pseudo domain name database includes characters, each of the characters being electronically associated with a visually similar character or visually similar characters useable in a phishing attack domain name generation process, wherein the web server is in operable communication with the pseudo domain name database. ### Claim 18 (depends on 17) The system according to claim 17, wherein: (i) the web server is in operable communication with the pseudo domain name database, (ii) the web server also functions as a target domain name analysis unit that analyzes one or more features and attributes of the identified the target domain name to identify each of the characters in at least a second-level domain name portion and a top-level domain name portion of each of the target domain name, (iii) when the web server function as a phishing attack domain name generation unit, the web server identifies one or more characters in the pseudo domain name database to substitute in a place of one or more characters in at least one of the target domain name based on the analysis at the target domain name analysis unit, and (iv) the web server functioning as the phishing attack domain name generation unit generates at least one of the plurality of phishing attack domain names by substituting one or more characters from the pseudo domain name database into the target domain name. ### Claim 19 (depends on 18) The system of claim 18, wherein the target domain name analysis unit also compares each character in the second-level domain name portion of the at least one of the target domain name to the characters in the pseudo domain name database to determine whether any of the characters in the second-level domain name portion has a corresponding visually similar character or characters in the pseudo domain name database, and wherein the target domain name analysis unit communicates to the phishing attack domain name generation unit each of the characters in the second-level domain name portion having a corresponding visually similar character or characters in the pseudo domain name database and an indication of which visually similar character or characters in the pseudo domain name database that corresponds to each character of the second-level domain name portion of the target domain name. ### Claim 20 A method of mitigating risks of a cyber intrusion attack against a computer network using an attack domain name, the method comprising: configuring a web server to convert target entity data to target domain name input to generate a plurality of phishing domain names; at the web server: receiving, via a network, target entity data, wherein target entity data includes data indicating a target entity and at least one target entity domain name that is useable to generate fictitious domain names for the target entity; transforming the at least one target entity domain name into a plurality of phishing attack domain names that each have a probability of being used in a phishing attack against the computer network of the target entity; implementing one or more computer network security protocols that mitigate the probabilities that the plurality of phishing attack domain names will be used in the phishing attack against the computer network.