Domain name and URL visual verification for increased security
Techniques for providing domain name and URL visual verifications to increase security of operations on a device. The techniques include a visual indicator and/or warning to a user on the user's computing device that a domain or URL requested by the user and the device is unpopular, new, unknown, inauthentic, associated with malware or phishing, or in some other way, risky. The techniques include identifying a domain name in a communication received by a computing device and then determining a popularity ranking and/or an age of the domain name. The device can render, for display on a screen of the device, a visual indicator having the popularity ranking and/or the age of the domain name. Also, the techniques can include identifying a URL in a communication received by a computing device and then rendering, for display on a screen of the device, a visual indicator having the entire URL.
1. A method comprising:
identifying, by a security application running on a computing device, a domain name in a communication received by the computing device;
determining, by the security application, whether the domain name is to be further evaluated, comprising:
determining a popularity ranking of the domain, the popularity ranking representing a volume of requests associated with the domain name;
determining whether the popularity ranking is below a popularity threshold; and
determining that the domain name is to be further evaluated when the popularity ranking is below the popularity threshold; and
when it is determined that the domain name is to be further evaluated:
rendering for display on a screen of the computing device, by the security application, a visual indicator that the domain name is to be further evaluated; and
rendering for display on the screen, by the security application, text describing the domain name along with the visual indicator, wherein the text describing the domain name comprises the domain name.
2. The method of claim 1 , wherein the determining of whether the domain name is to be further evaluated, further comprises:
determining an age of the domain name;
determining whether the age is below an age threshold; and
determining that the domain name is to be further evaluated when the age is below the age threshold and the popularity ranking is below the popularity threshold; and
wherein the text describing the domain name comprises the domain name, the age, and the popularity ranking.
3. The method of claim 2 , further comprising:
determining, by the security application, whether the domain name is almost similar to an accepted domain name in that a similarity score of the domain name with respect to the accepted domain name exceeds a configurable threshold; and
if the domain name is determined as almost similar to the accepted domain name, weighting and performing the determining of whether the domain name is to be further evaluated.
4. The method of claim 3 , wherein the weighting of the determination of whether the domain name is to be further evaluated comprises weighting the popularity threshold, the popularity ranking, the age threshold, or the age according to a configurable weight.
5. The method of claim 4 , further comprising configuring the configurable weight according to the similarity score.
6. The method of claim 1 , wherein identifying the domain names comprises identifying the domain name from a uniform resource locator (URL) received by a web browser running on the computing device that received the URL from a user input into the web browser, and
wherein the method further comprises rendering for display on the screen, by the security application, the URL.
7. The method of claim 1 , further comprising the security application operating in or providing a DNS resolver.
8. The method of claim 7 , further comprising:
receiving, by a user interface of the computing device, a URL from a user entering at least part of the communication; and
resolving, by the DNS resolver, the domain name based on the received URL.
9. The method of claim 1 , further comprising the security application operating in or providing a transparent proxy.
10. The method of claim 1 , further comprising determining, by the security application, whether the domain name is to be blocked, accepted immediately, or further evaluated, the determination of whether the domain name is to be blocked, accepted immediately, or further evaluated, comprising:
determining whether the domain name is to be blocked according to a first list of domain names comprising domain names to be blocked;
determining whether the domain name is to be accepted immediately according to a second list of domain names comprising domain names to be accepted immediately; and
if the domain name is determined not to be blocked and not to be accepted immediately, performing the determining of whether the domain name is to be further evaluated.
11. The method of claim 10 , further comprising:
blocking, by the security application, the domain name, which comprises configuring the computing device to be prohibited from requesting resources using URLs comprising the domain name, when it is determined that the domain name is to be blocked; and
accepting, by the security application, the domain name, which comprises configuring the computing device to be permitted to request resources using URLs comprising the domain name, when it is determined that the domain name is to be accepted immediately.
12. The method of claim 1 , further comprising determining, by the security application, whether the domain name is to be blocked, accepted immediately, or further evaluated, based on criteria cached or stored in the computing device or a network device communicatively coupled to the computing device over a computer network,
the determination of whether the domain name is to be blocked, accepted immediately, or further evaluated, comprising:
determining whether the domain name is listed to be blocked according to a first list cached or stored in the computing device or in the network device;
determining whether the domain name is listed to be accepted immediately according to a second list cached or stored in the computing device or in the network device; and
if the domain name is determined not to be blocked and not to be accepted immediately, performing the determining of whether the domain name is to be further evaluated.
13. The method of claim 12 , further comprising:
blocking, by the security application, the domain name, which comprises configuring the computing device to be prohibited from requesting resources using URLs comprising the domain name, when it is determined that the domain name is to be blocked; and
accepting, by the security application, the domain name, which comprises configuring the computing device to be permitted to request resources using URLs comprising the domain name, when it is determined that the domain name is to be accepted immediately.
14. The method of claim 1 , further comprising:
determining, by the security application, whether the domain name matches at least part of a URL included in a web browsing history stored or cached in the computing device; and
if the domain name is determined not to match at least part of a URL included in the web browsing history, performing the determining of whether the domain name is to be further evaluated.
15. The method of claim 14 , further comprising weighting the determining of whether the domain name is to be further evaluated.
16. The method of claim 15 , wherein the weighting of the determination of whether the domain name is to be further evaluated comprises weighting the popularity threshold or the popularity ranking according to a configurable weight.
17. The method of claim 1 , further comprising:
sending over a network, by the security application, the domain name to one or more computing devices for further evaluation of the domain name by the one or more computing devices;
receiving over the network, by the security application, a further evaluation of the domain name from the one or more computing devices;
determining, by the security application, whether the domain name is to be blocked, accepted, or further evaluated, based on the received further evaluation of the domain name from the one or more computing devices; and
rendering for display on the screen, by the security application, a second visual indicator that the domain name is blocked, accepted, or undergoing further evaluation.
18. A non-transitory computer readable storage medium storing computer readable instructions, which when executed, cause a computing system to:
identify a domain name in a communication received by the computing system;
determine a popularity ranking or an age of the domain name, the popularity ranking representing a volume of requests associated with the domain name;
render, for display on a screen of the computing system, a first visual indicator comprising the domain name, the popularity ranking or the age of the domain name;
send, over a network, the domain name to one or more computing devices for further evaluation of the domain name by the one or more computing devices;
receive, over the network, a further evaluation of the domain name from the one or more computing devices;
determine whether the domain name is to be further evaluated, based on the received further evaluation of the domain name from the one or more computing devices; and
render, for display on the screen, a second visual indicator that the domain name is undergoing further evaluation.
19. The storage medium of claim 18 , wherein the determining whether the domain name is to be further evaluated comprises determining that the age of the domain name is below an age threshold.
20. A non-transitory computer readable storage medium storing computer readable instructions, which when executed, cause a computing system to:
identify a domain name in a communication received by the computing system;
determine a popularity ranking and an age of the domain name, by:
determining the popularity ranking of the domain name according to a set of popularity rankings of domain names or URLs provided by a third-party service, the popularity ranking representing a volume of requests associated with the domain name; and
determining the age of the domain name according to domain information comprising new domain registration date of the domain name or a domain change of ownership date of the domain name;
render, for display on a screen of the computing system, a visual indicator comprising text that comprises the domain name, the age, or the popularity ranking;
send, over a network, the domain name to one or more computing devices for further evaluation of the domain name by the one or more computing devices; and
receive, over the network, a further evaluation of the domain name from the one or more computing devices.
21. The storage medium of claim 20 , wherein the instructions further cause the computing system to:
determine whether the domain name is to be further evaluated, based on the received further evaluation of the domain name from the one or more computing devices; and
render, for display on the screen, a second visual indicator that the domain name is undergoing further evaluation.
22. The storage medium of claim 21 , wherein the determining whether the domain name is to be further evaluated comprises determining that the age of the domain name is below an age threshold.