Back to results
US 2022/0070194 A1Published application
Techniques for detecting domain threats
AssigneeMicrosoft Technology Licensing, LLC
InventorsSteven Alexander Daniel Pon, Adam Hunt, Jonas Edgeworth, Chris Kiernan, Elias Manousos, David Pon, Jonathan Matkowsky
Life of this patent
Estimating the term…
Abstract
An inventory of Internet-facing assets related to a username within a social media site is generated using network data gathered from network data sources. Using data sources of known threats, such as malware, phishing attempts, scam pages, blacklisted sites, and so on, a network analytic system generates analytical information about components that are owned, managed, and/or controlled by a target entity. A measure of identity threat is generated based on a classification model using the analytical information.
Claims20
A method comprising, at a computer system:
- monitoring network data from one or more data sources;
- based on detecting, in the network data, a network event related to a username within a social media site:
- identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
- generating, by converting from a first format of the identifier, a converted identifier having a second format;
- determining one or more words associated with the identity of the entity;
- determining a measure of similarity of the converted name to each of the one or more words associated with the identity of the entity;
- determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity;
- generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source;
- and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
6 more elements
One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
- monitoring network data from one or more data sources;
- based on detecting, in the network data, a network event related to a username within a social media site:
- identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
- generating, by converting from a first format of the name, a converted identifier having a second format;
- determining one or more words associated with the identity of the entity;
- determining a measure of similarity of the converted name to each of the one or more words associated with the identity of the entity;
- determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity;
- generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source;
- and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
6 more elements
A system, comprising:
- one or more computing processors;
- one or more non-transitory computer readable media storing a program of instructions that is executable by the one or more computing processors to perform:
- monitoring network data from one or more data sources;
- based on detecting, in the network data, a network event related to a username within a social media site:
- identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
- generating, by converting from a first format of the identifier, a converted identifier having a second format;
- determining one or more words associated with the identity of the entity;
- determining a measure of similarity of the converted name to each of the one or more words associated with the identity of the entity;
- determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity;
- generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source;
- and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
8 more elements
Dependencies are inferred from the claim text.