US 2024/0267395 A1Published application

Polymorphic Non-Attributable Website Monitor

AssigneeBank of America Corporation

InventorsRobert Zink, Eric DePree, Stephanie Pirman, Jared Wilson

Life of this patent

Estimating the term…

Loading patent…

Abstract

Polymorphic non-attributable processes and architectures to monitor threat domains (e.g., pharming or phishing websites) are disclosed. Obfuscated requests may be generated by control servers to be blended in with normal traffic sent over cloud networks with randomized exit nodes or with normal traffic sent through an anonymization network. Requests may be sent at randomized intervals or time periods determined algorithmically. The requests are obfuscated in order to mask the origination information and location so that the threat actor does not detect that the website is being monitored. User agents may be spoofed and requests may present as if they originated from residential IP addresses. Automatic real-time monitoring can be provided to determine when sites resolve and are addressable. Fingerprint information, screenshots, security certificate, and other threat domain data can be captured. Request responses can be scanned for threat indicia.

Claims20

Dependent claims

A polymorphic non-attributable website monitoring process comprising the steps of:

identifying, by a control server, a threat domain to monitor;
determining, by the control server, first obfuscating criteria;
generating, by the control server, a first obfuscated request based on the first obfuscating criteria;
transmitting, by the control server, the first obfuscated request to the threat domain;
determining, by the control server, whether the threat domain resolves;
determining, by the control server, whether the threat domain is accessible;
storing, by the control server in a database, whether the threat domain resolved and whether the threat domain was accessible;
if the threat domain resolved and was accessible:
capturing, by the control server from the threat domain, site information;
generating, by the control server based on the site information, a current fingerprint for the threat domain;
comparing, by the control server based, the current fingerprint to a prior fingerprint to determine if the threat domain has changed;
capturing, by the control server from the threat domain, a screenshot if the threat domain has changed or if the threat domain was not previously observed;
capturing, by the control server from the threat domain, a response to the first obfuscated request;
determining, by the control server, whether the threat domain is secure;
capturing, by the control server from the threat domain, certificate information if the threat domain is secure;
and
storing, by the control server in the database, data observed from the threat domain.

14 more elements

A polymorphic non-attributable website monitoring process comprising the steps of:

identifying, by a control server, a threat domain to monitor;
determining, by the control server, whether the threat domain resolves and is accessible;
generating, by the control server, a first network-level obfuscated request that spoofs a first user agent and fakes, as a first residential IP address, an actual IP address for the control server;
transmitting, by the control server, the first network-level obfuscated request to the threat domain through a cloud network, said first network-level obfuscated request exiting the cloud network through a first exit node, said first network-level obfuscated request blended into normal traffic to the threat domain;
capturing, by the control server from the threat domain, a screenshot, a first response to the first network-level obfuscated request, and security certificate information;
generating, by the control server, a first fingerprint for the threat domain;
scanning, by the control server, the screenshot and first response for threat indicia including a fake logo;
generating, by the control server, a second network-level obfuscated request that spoofs a first user agent and fakes, as a second residential IP address, the actual IP address for the control server;
transmitting, by the control server after a randomized time interval, the second network-level obfuscated request to the threat domain through the cloud network, said second network-level obfuscated request exiting the cloud network through a second exit node, said first exit node differing from said second exit node, said second network-level obfuscated request blended into said normal traffic to the threat domain;
capturing, by the control server from the threat domain, a second response to the second network-level obfuscated request;
generating, by the control server, a second fingerprint for the threat domain;
scanning, by the control server, the second response for said threat indicia including the fake logo;
comparing, by the control server, the first fingerprint to the second fingerprint to determine any change to the threat domain;
determining, by the control server, whether a threat exists based on the threat indicia;
storing, by the control server in a database, whether the threat domain resolved and was accessible, the first fingerprint, the second fingerprint, the first response, the second response, and the threat indicia;
and
generating, by the control server based on the threat indicia, a notification regarding whether the threat domain is pharming or phishing.

14 more elements

A polymorphic non-attributable website monitoring process comprising the steps of:

identifying, by a control server, a threat domain to monitor;
determining, by the control server, whether the threat domain resolves and is accessible;
generating, by the control server, a first network-level obfuscated request that spoofs a first user agent and fakes, as a first residential IP address, an actual IP address for the control server;
transmitting, by the control server, the first network-level obfuscated request to the threat domain through an anonymization network, said first network-level obfuscated request blended into normal traffic to the threat domain;
capturing, by the control server from the threat domain, a screenshot, a first response to the first network-level obfuscated request, and security certificate information;
generating, by the control server, a first fingerprint for the threat domain;
scanning, by the control server, the screenshot and first response for threat indicia including a fake logo;
generating, by the control server, a second network-level obfuscated request that spoofs a first user agent and fakes, as a second residential IP address, the actual IP address for the control server;
transmitting, by the control server after a randomized time interval, the second network-level obfuscated request to the threat domain through the anonymization network, said second network-level obfuscated request blended into said normal traffic to the threat domain;
capturing, by the control server from the threat domain, a second response to the second network-level obfuscated request;
generating, by the control server, a second fingerprint for the threat domain;
scanning, by the control server, the second response for said threat indicia including the fake logo;
comparing, by the control server, the first fingerprint to the second fingerprint to determine any change to the threat domain;
determining, by the control server, whether a threat exists based on the threat indicia;
storing, by the control server in a database, whether the threat domain resolved and was accessible, the first fingerprint, the second fingerprint, the first response, the second response, and the threat indicia;
and
generating, by the control server based on the threat indicia, a notification regarding whether the threat domain is pharming or phishing.

14 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/106,041Filed 6 Feb 2023
Published: 8 Aug 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/0407
For providing a confidential data exchange among entities communicating through data packet networks: wherein the identity of one or more…
H04L 63/0823
For authentication of entities: using certificates
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection

Family

US 12,255,908 B2Related patent
US 2024/0267395 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key