Entity IP mapping
Systems and methods for mapping IP addresses to an entity include receiving at least one domain name associated with the entity. Embodiments may further include determining one or more variations of the at least one domain name based on analysis of domain name data collected from a plurality of domain name data sources that mention a variation of the at least one domain name. Some embodiments may also include identifying one or more IP addresses pointed to by the one or more variations of the entity's domain name based on analysis of IP address data collected from a plurality of IP address data sources. Additional embodiments include assigning weights to each of the identified one or more IP addresses and creating a mapping of IP addresses to associate with the entity based on analysis of the weighted one or more IP addresses.
1. A method for mapping Internet Protocol (IP) addresses to an entity, the method comprising:
receiving, by one or more processors, one or more domain names associated with the entity;
identifying, by the one or more processors, one or more variations of the one or more domain names based on analysis of domain name data collected from a plurality of domain name data sources;
identifying, by the one or more processors, one or more IP addresses pointed to by the identified one or more variations of the one or more domain names based on analysis of IP address data collected from a plurality of IP address data sources;
determining, by the one or more processors, a correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names; and
mapping at least one of the identified one or more IP addresses to the entity based on the determined correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
2. The method of claim 1 where identifying one or more IP addresses comprises collecting one or more IP addresses that map to the one or more variations of the one or more domain names.
3. The method of claim 1 where determining the correlation comprises:
assigning a larger weight to an IP address of the identified one or more IP addresses that relates to multiple of the one or more variations of the one or more domain names; and
assigning a smaller weight to an IP address of the identified one or more IP addresses that relates to only one of the one or more variations of the one or more domain names.
4. The method of claim 1 further comprising:
updating the association based on user input.
5. The method of claim 1 further comprising:
re-mapping at least one of the identified one or more IP addresses to the entity based on an updated correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
6. The method of claim 1 further comprising:
associating IP addresses with networks other than the entity's network based on at least one of user input and detection of IP addresses not having access to data internal to the entity.
7. The method of claim 6 where the networks other than the entity's network comprise at least one of a Wi-Fi, third-party hosting, guest, or security network.
8. A non-transitory computer-readable medium comprising instructions that are executable and when executed cause a computing system to map Internet Protocol (IP) addresses to an entity by:
receiving, by one or more processors, one or more domain names associated with the entity;
identifying, by the one or more processors, one or more variations of the one or more domain names based on analysis of domain name data collected from a plurality of domain name data sources;
identifying, by the one or more processors, one or more IP addresses pointed to by the identified one or more variations of the one or more domain names based on analysis of IP address data collected from a plurality of IP address data sources;
determining, by the one or more processors, a correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names; and
mapping at least one of the identified one or more IP addresses to the entity based on the determined correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
9. The non-transitory computer-readable medium of claim 8 where identifying one or more IP addresses comprises collecting one or more IP addresses that map to the one or more variations of the one or more domain names.
10. The non-transitory computer-readable medium of claim 8 where determining the correlation comprises:
assigning a larger weight to an IP address of the identified one or more IP addresses that relates to multiple of the one or more variations of the one or more domain names; and
assigning a smaller weight to an IP address of the identified one or more IP addresses that relates to only one of the one or more variations of the one or more domain names.
11. The non-transitory computer-readable medium of claim 8 further comprising instructions to cause the one or more processors to update the association based on user input.
12. The non-transitory computer-readable medium of claim 8 further comprising instructions to cause the one or more processors to perform the step of re-mapping at least one of the identified one or more IP addresses to the entity based on an updated correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
13. The non-transitory computer-readable medium of claim 10 further comprising instructions to cause the one or more processors to perform the step of associating IP addresses with networks other than the entity's network based on at least one of user input and detection of IP addresses not having access to data internal to the entity.
14. The non-transitory computer-readable medium of claim 13 where the networks other than the entity's network comprise at least one of a Wi-Fi, third-party hosting, guest, or security network.
15. An apparatus that maps Internet Protocol (IP) addresses to an entity, the apparatus comprising:
one or more processors; and
a non-transitory computer-readable memory communicatively coupled to the one or more processors and containing program code configured to cause the one or more processors to perform operations including:
receiving, by one or more processors, one or more domain names associated with the entity;
identifying, by the one or more processors, one or more variations of the one or more domain names based on analysis of domain name data collected from a plurality of domain name data sources;
identifying, by the one or more processors, one or more IP addresses pointed to by the identified one or more variations of the one or more domain names based on analysis of IP address data collected from a plurality of IP address data sources;
determining, by the one or more processors, a correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names; and
mapping at least one of the identified one or more IP addresses to the entity based on the determined correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
16. The apparatus of claim 15 where identifying one or more IP addresses comprises collecting one or more IP addresses that map to the one or more variations of the one or more domain names.
17. The apparatus of claim 15 where determining the correlation comprises:
assigning a larger weight to an IP address of the identified one or more IP addresses that relates to multiple of the one or more variations of the one or more domain names; and
assigning a smaller weight to an IP address of the identified one or more IP addresses that relates to only one of the one or more variations of the one or more domain names.
18. The apparatus of claim 15 where the one or more processors is further configured to perform the step of updating the association based on user input.
19. The apparatus of claim 15 where the one or more processors is further configured to perform the step of re-mapping at least one of the identified one or more IP addresses to the entity based on an updated correlation between the identified one or more IP addresses and the identified one or more variations of the one or more domain names.
20. The apparatus of claim 15 where the one or more processors is further configured to perform the step of associating IP addresses with networks other than the entity's network based on at least one of user input and detection of IP addresses not having access to data internal to the entity.