IP Library Granted Patent US 11,973,799
Granted Patent B2
US 11,973,799 · App. 17/212,997 · Granted Apr 30, 2024

Domain name processing systems and methods

Inventors: Hung-Jen Chang (Fremont, CA); Ali Mesdaq (San Jose, CA); Gaurav Dalal (Fremont, CA); Kevin Dedon (Austin, TX)
Assignee: PROOFPOINT, INC.
H04L63/1483G06F40/205G06F40/279H04L61/3005H04L61/4511
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,973,799
App. No.
17/212,997
Granted
Apr 30, 2024
Kind
B2
Abstract

A domain processing system is enhanced with a first-pass domain filter configured for loading character strings representing a pair of domains consisting of a seed domain and a candidate domain in a computer memory, computing a similarity score and a dynamic threshold for the pair of domains, determining whether the similarity score exceeds the dynamic threshold, and iterating the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain. A similarity score between the seed domain and the candidate domain and a corresponding dynamic threshold for the pair are computed. If the similarity score exceeds the corresponding dynamic threshold, the candidate domain is provided to a downstream computing facility. Otherwise, it is dropped. In this way, the first-pass domain filter can significantly reduce the number of domains that otherwise would need to be processed by the downstream computing facility.

Claims (92)

1. A method for domain processing, comprising:

loading, in a computer memory of a computing device by a first-pass domain filter running on the computing device, character strings representing a pair of domains, the pair of domains consisting of a seed domain and a candidate domain;

computing, by the first-pass domain filter, a similarity score and a dynamic threshold for the pair of domains in the computer memory;

determining, by the first-pass domain filter, whether the similarity score exceeds the dynamic threshold;

iterating, by the first-pass domain filter, the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain;

determining, based at least on the iterating, candidate domains of the plurality of candidate domains in which a similarity score between the seed domain and a respective candidate domain of the candidate domains exceeds a corresponding dynamic threshold; and

providing, by the first-pass domain filter, the candidate domains to a downstream computing facility.

2. The method according to claim 1 , further comprising:

iterating, by the first-pass domain filter, the loading, the computing, the determining, and the iterating for each of a plurality of seed domains.

3. The method according to claim 1 , further comprising:

extracting, by the first-pass domain filter, a significant fragment from each respective character string of the character strings;

representing the significant fragment thus extracted in a respective character array, the respective character array having a corresponding array length;

determining a tolerance range of a position index for the respective character string using the corresponding array length;

determining whether characters in the respective character string within the tolerance range of the position index are identical; and

determining a character order for the respective character string, wherein the similarity score is computed using a number of matching characters, the character order, and the corresponding array length.

4. The method according to claim 1 , wherein the dynamic threshold is computed using a string length of the seed domain and a string length of the candidate domain.

5. The method according to claim 1 , further comprising:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain; and

determining whether the character string corresponding to the candidate domain contains any homoglyph.

6. The method according to claim 5 , further comprising:

responsive to the character string being determined as containing at least a homoglyph:

converting the character string to a candidate domain character string without any homoglyph; and

repeating the loading, the computing, and the determining for the candidate domain character string paired with the seed domain.

7. The method according to claim 1 , further comprising:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain;

determining whether the character string contains abnormal or repeating characters;

modifying the character string to remove any abnormal or repeating characters from the character string to produce a modified character string; and

repeating the loading, the computing, and the determining for the modified character string paired with the seed domain.

8. A system for domain processing, comprising:

a processor;

a non-transitory computer-readable medium; and

stored instructions translatable by the processor to cause a first-pass domain filter to perform:

loading, in a computer memory, character strings representing a pair of domains, the pair of domains consisting of a seed domain and a candidate domain;

computing a similarity score and a dynamic threshold for the pair of domains in the computer memory;

determining whether the similarity score exceeds the dynamic threshold;

iterating the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain;

determining, based at least on the iterating, candidate domains of the plurality of candidate domains in which a similarity score between the seed domain and a respective candidate domain of the candidate domains exceeds a corresponding dynamic threshold; and

providing the candidate domains to a downstream computing facility.

9. The system of claim 8 , wherein the stored instructions are further translatable by the processor to cause the first-pass domain filter to perform:

iterating the loading, the computing, the determining, and the iterating for each of a plurality of seed domains.

10. The system of claim 8 , wherein the stored instructions are further translatable by the processor to cause the first-pass domain filter to perform:

extracting a significant fragment from each respective character string of the character strings;

representing the significant fragment thus extracted in a respective character array, the respective character array having a corresponding array length;

determining a tolerance range of a position index for the respective character string using the corresponding array length;

determining whether characters in the respective character string within the tolerance range of the position index are identical; and

determining a character order for the respective character string, wherein the similarity score is computed using a number of matching characters, the character order, and the corresponding array length.

11. The system of claim 8 , wherein the dynamic threshold is computed using a string length of the seed domain and a string length of the candidate domain.

12. The system of claim 8 , wherein the stored instructions are further translatable by the processor to cause the first-pass domain filter to perform:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain; and

determining whether the character string corresponding to the candidate domain contains any homoglyph.

13. The system of claim 11 , wherein the stored instructions are further translatable by the processor to cause the first-pass domain filter to perform:

responsive to the character string being determined as containing at least a homoglyph:

converting the character string to a candidate domain character string without any homoglyph; and

repeating the loading, the computing, and the determining for the candidate domain character string paired with the seed domain.

14. The system of claim 8 , wherein the stored instructions are further translatable by the processor to cause the first-pass domain filter to perform:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain;

determining whether the character string contains abnormal or repeating characters;

modifying the character string to remove any abnormal or repeating characters from the character string to produce a modified character string; and

repeating the loading, the computing, and the determining for the modified character string paired with the seed domain.

15. A computer program product for domain processing, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to cause a first-pass domain filter to perform:

loading, in a computer memory, character strings representing a pair of domains, the pair of domains consisting of a seed domain and a candidate domain;

computing a similarity score and a dynamic threshold for the pair of domains in the computer memory;

determining whether the similarity score exceeds the dynamic threshold;

iterating the loading, the computing, and the determining for each of a plurality of candidate domains paired with the seed domain;

determining, based at least on the iterating, candidate domains of the plurality of candidate domains in which a similarity score between the seed domain and a respective candidate domain of the candidate domains exceeds a corresponding dynamic threshold; and

providing the candidate domains to a downstream computing facility.

16. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to cause the first-pass domain filter to perform:

iterating the loading, the computing, the determining, and the iterating for each of a plurality of seed domains.

17. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to cause the first-pass domain filter to perform:

extracting a significant fragment from each respective character string of the character strings;

representing the significant fragment thus extracted in a respective character array, the respective character array having a corresponding array length;

determining a tolerance range of a position index for the respective character string using the corresponding array length;

determining whether characters in the respective character string within the tolerance range of the position index are identical; and

determining a character order for the respective character string, wherein the similarity score is computed using a number of matching characters, the character order, and the corresponding array length.

18. The computer program product of claim 15 , wherein the dynamic threshold is computed using a string length of the seed domain and a string length of the candidate domain.

19. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to cause the first-pass domain filter to perform:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain;

determining whether the character string corresponding to the candidate domain contains any homoglyph; and

responsive to the character string being determined as containing at least a homoglyph:

converting the character string to a candidate domain character string without any homoglyph; and

repeating the loading, the computing, and the determining for the candidate domain character string paired with the seed domain.

20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to cause the first-pass domain filter to perform:

responsive to the similarity score not exceeding the dynamic threshold:

analyzing a character string corresponding to the candidate domain;

determining whether the character string contains abnormal or repeating characters;

modifying the character string to remove any abnormal or repeating characters from the character string to produce a modified character string; and

repeating the loading, the computing, and the determining for the modified character string paired with the seed domain.

Assignments (5)
SECOND LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Dec 8, 2025
From: PROOFPOINT, INC.
To: U.S. BANK TRUST COMPANY, NATIONAL ASSOCIATION, AS COLLATERAL AGENT
Reel/Frame 073889/0677 →
RELEASE OF SECOND LIEN SECURITY INTEREST IN INTELLECTUAL PROPERTY Recorded Mar 21, 2024
From: GOLDMAN SACHS BANK USA, AS AGENT
To: PROOFPOINT, INC.
Reel/Frame 066865/0648 →
FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Aug 31, 2021
From: PROOFPOINT, INC.
To: GOLDMAN SACHS BANK USA, AS COLLATERAL AGENT
Reel/Frame 057389/0615 →
SECOND LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Aug 31, 2021
From: PROOFPOINT, INC.
To: GOLDMAN SACHS BANK USA, AS COLLATERAL AGENT
Reel/Frame 057389/0642 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 21, 2021
From: CHANG, HUNG-JEN; MESDAQ, ALI; DALAL, GAURAV MITESH; DEDON, KEVIN
To: PROOFPOINT, INC.
Reel/Frame 055995/0424 →