Domain reputation evaluation process and method

1. A computer-implemented method for identifying malicious domains by predictively assigning a score to each domain based upon attribute information associated with each domain, comprising:

under control of the computer, given initial input data of domain related information, containing at least some domain names, IP address locations, and/or nameserver hostnames, augmenting the input data by:

using passive DNS data, determining a set of domains which are active domains and augmenting the input data with any determined additional domains;

executing a DNS crawl of all domains identified in the augmented input data to resolve identified domains, the executed DNS crawl resulting in determining associated IP address location information for identified domains and further augmenting the input data with the associated IP address location information;

extracting nameserver hostnames from DNS data and further augmenting the input data with the extracted nameserver hostnames; and

identifying and retrieving from Whois data records registration data associated with each domain present in the Whois data records, the registration data including email addresses and registrant names, and further augmenting the input data to associate the retrieved domain registration data with each corresponding domain;

under control of the computer, retrieving information regarding domains and/or IP address locations that are listed on blacklist data as blacklist input data; and

under control of the computer, determining a proximity score for each domain in the augmented input data by determining a separate attribute score for each domain attribute for each domain and selecting the maximum attribute score as the proximity score for each domain, the proximity score indicating likelihood that the corresponding domain is malicious based upon similarities of the corresponding domain to the blacklist input data, wherein a domain attribute is at least two of IP address location, nameserver hostname, or registrant data, and wherein determining the proximity score for each domain in the augmented input data, further comprises:

for each value of each domain attribute,

determining the domains that correspond to the domain attribute value;

determining counts detailing a total number of the determined domains, a total number of active domains that count the determined domains that are active, a number of active blacklist domains that count the number of active domains that appear on the blacklist input data; and a number of blacklist domains that count the number of determined domains that appear on the blacklist input data;

determining a total ratio of the number of blacklist domains to the total number of determined domains;

determining an active ratio of the number of active blacklist domains to the total number of active domains; and

for each of the determined domain, assigning an attribute score that reflects either the total ratio or the active ratio, whichever reflects a higher proportion of blacklist domains.

2. The method of claim 1 wherein the attribute score is a the greater of the total ratio or the active ratio.

3. The method of claim 1 wherein the attribute score is the total ratio or the active ratio, whichever is greater, converted to a score between 0 and 100.

4. The method of claim 1 wherein the domain attributes include IP address location and nameserver hostname.

5. The method of claim 1 wherein the domain attributes include registrant name or registration email address.

6. The method of claim 1 wherein the number of blacklist domains and the number of active blacklist domains are each multiplied by a factor if the value of the domain attribute is a value appearing on blacklist data.

7. The method of claim 1 , further comprising executing a set of rules to exclude data from the augmented input data.

8. The method of claim 7 wherein the rules further comprise excluding ambiguous registrant name data from the augmented input data, wherein ambiguous registrant name data is determined when a registrant name is associated with a variation of registration email addresses.

9. The method of claim 7 wherein the rules further comprise excluding domains from the augmented input data that have been listed as highly trafficked by their inclusion on a public list of top domains.

10. The method of claim 7 wherein the rules further comprise excluding from the augmented input data predesignated domains that are not malicious.

11. The method of claim 7 wherein the rules further comprise:

when, upon identifying and retrieving from Whois data records registration data associated with each domain present in the Whois data records, the retrieved registrant name matches the associated domain name, excluding from the augmented input data the retrieved registrant name.

12. The method of claim 1 wherein the blacklist input data further comprises an identification of threat or designation.

13. The method of claim 12 wherein the threat is at least one of Malware, Spam, Phishing, and infrastructure Botnet.

14. The method of claim 13 , further comprising;

under control of the computer, flagging as malicious suspect domains based upon associated proximity scores.

15. The method of claim 1 , further comprising: tracking amount of change in each domain proximity score daily.

16. The method of claim 1 , further comprising using age of each domain in the augmented input data as an additional domain attribute and as input to the proximity score of each domain.

17. The method of claim 1 , further comprising performing the method responsive to discovery or detection of a newly registered domain.

18. The method of claim 1 , further comprising: reevaluating the proximity score of domains on a regular basis.