Clustering domains for vulnerability scanning

1. A computer-implemented method, comprising:

detecting, at a network analysis system, a set of related nodes associated with a target domain;

defining a similarity metric comprising a weighted linear combination of one or more features;

calculating similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;

determining a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;

selecting a centroid node from the set of related nodes based on the centroid node having a betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes; and

performing an action on the centroid node at the network analysis system.

2. The method of claim 1 , wherein the set of related nodes is detected by executing a document object model (DOM) object associated with the target domain and hashing each page component into a binary signature.

3. The method of claim 1 , wherein the similarity metric is further defined based on one or more heuristics in the weighted linear combination.

4. The method of claim 1 , wherein a related node is determined as connected to a potential threat actor and wherein the action comprises tagging the potential threat actor as associated with the centroid node.

5. The method of claim 1 , wherein the one or more features includes routing protocols, autonomous systems, internet protocol (IP) header information, or business criteria.

6. The method of claim 1 , further comprising storing the similarity scores associated with the respective pairs of related nodes in a data store associated with the network analysis system.

7. The method of claim 1 , further comprising:

receiving a new weight associated with a particular feature of the one or more features, the new weight received through an application programming interface (API); and

updating the weighted linear combination of the one or more features with the new weight associated with the particular feature.

8. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

detecting, at a network analysis system, a set of related nodes associated with a target domain;

defining a similarity metric comprising a weighted linear combination of one or more features;

calculating similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;

determining a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;

selecting a centroid node from the set of related nodes based on the centroid node having betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes; and

performing an action on the centroid node at the network analysis system.

9. The one or more non-transitory computer-readable storage media of claim 8 , wherein the set of related nodes is detected by executing a document object model (DOM) object associated with the target domain and hashing each page component into a binary signature.

10. The one or more non-transitory computer-readable storage media of claim 8 , wherein the similarity metric is further defined based on one or more heuristics in the weighted linear combination.

11. The one or more non-transitory computer-readable storage media of claim 8 , wherein a related node is determined as connected to a potential threat actor and wherein the action comprises tagging the potential threat actor as associated with the centroid node.

12. The one or more non-transitory computer-readable storage media of claim 8 , wherein the one or more features includes routing protocols, autonomous systems, internet protocol (IP) header information, or business criteria.

13. The one or more non-transitory computer-readable storage media of claim 8 , wherein the one or more sequences of instructions, when executed by one or more processors, cause performance of:

storing the similarity scores associated with the respective pairs of related nodes in a data store associated with the network analysis system.

14. The one or more non-transitory computer-readable storage media of claim 8 , wherein the one or more sequences of instructions, when executed by one or more processors, cause performance of:

receiving a new weight associated with a particular feature of the one or more features, the new weight received through an application programming interface (API); and

updating the weighted linear combination of the one or more features with the new weight associated with the particular feature.

15. An apparatus, comprising:

a subsystem, implemented at least partially in hardware, that detects, at a network analysis system, a set of related nodes associated with a target domain;

a subsystem, implemented at least partially in hardware, that defines a similarity metric comprising a weighted linear combination of one or more features;

a subsystem, implemented at least partially in hardware, that calculates similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;

a subsystem, implemented at least partially in hardware, that determines a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;

a subsystem, implemented at least partially in hardware, that selects a centroid node from the set of related nodes based on the centroid node having a betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes; and

a subsystem, implemented at least partially in hardware, that performs an action on the centroid node at the network analysis system.

16. The apparatus as recited in claim 15 , wherein the set of related nodes is detected by executing a document object model (DOM) object associated with the target domain and hashing each page component into a binary signature.

17. The apparatus as recited in claim 15 , wherein the similarity metric is further defined based on one or more heuristics in the weighted linear combination.

18. The apparatus as recited in claim 15 , wherein a related node is determined as connected to a potential threat actor and wherein the action comprises tagging the potential threat actor as associated with the centroid node.

19. The apparatus as recited in claim 15 , further comprising a subsystem, implemented at least partially in hardware, that stores the similarity scores associated with the respective pairs of related nodes in a data store associated with the network analysis system.

20. The apparatus as recited in claim 15 , further comprising:

a subsystem, implemented at least partially in hardware, that receives a new weight associated with a particular feature of the one or more features, the new weight received through an application programming interface (API); and

a subsystem, implemented at least partially in hardware, that updates the weighted linear combination of the one or more features with the new weight associated with the particular feature.