System and methods for spoofed domain identification and user training
AssigneeKnowBe4, Inc.
InventorsStu Sjouwerman, Alin Irimie, Greg Kras
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed that minimize ongoing risk to an organization from user behaviors which magnify the severity of a spoofed domain. Systems and method are provided which enable an entity and users of an entity to identify potential harmful domains, combining search, discovery, reporting, the generation of risk indicators, end-user risk assessments, and training into a security awareness system.
Claims20
A method comprising:
- identifying, by one or more processors via one or more tools, a first number of a plurality of spoofed domains of a domain name of an entity;
- identifying, by the one or more processes, a second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
- determining, by the one or more processors, a level of spoof risk for each of a plurality of uniform resource locators (URLs) identifying one of the plurality of spoofed domains based at least on a comparison of the first number to the second number;
- selecting, by the one or more processors, one or more URLs of the plurality of URLs registered to the one or more parties other than the entity based at least on the level of spoof risk;
- communicating, by the one or more processors, to one or more devices of one or more users an electronic training configured to train the one or more users to identify between the domain of the entity and the spoofed domain of the selected one or more URLs.
The method of claim, further comprising generating, by the one or more processors, the electronic training campaign based at least on one or more of the following;
- a difficulty rating, a profile of the one or more users, a training history of the one or more users, or a role of the one or more users.
A system comprising:
- or more processors, coupled to memory and configured to:
- identify, via one or more tools, a first number of a plurality of spoofed domains of a domain name of an entity;
- identify a second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
- determine a level of spoof risk for each of a plurality of uniform resource locators (URLs) identifying one of the plurality of spoofed domains based at least on a comparison of the first number to the second number;
- select one or more URLs of the plurality of URLs registered to the one or more parties other than the entity based at least on the level of spoof risk;
- communicate to one or more devices of one or more users an electronic training configured to train the one or more users to identify between the domain of the entity and the spoofed domain of the selected one or more URLs.
Dependencies are inferred from the claim text.