SYSTEM AND METHOD FOR DATA BREACH PROTECTION

1 . A method, comprising:

analyzing network traffic of an enterprise;

identifying Uniform Resource Locators (URLs) included in the network traffic;

classifying the URLs into a bipartite graph;

establishing classification sets of the bipartite graph;

displaying the classification sets;

in response to displaying the classification sets, receiving an instruction related to management of the network traffic.

2 . The method of claim 1 , wherein the instruction comprises an instruction to cease the transmission of data to a plurality of the URLs included in the network traffic.

3 . The method of claim 1 , further comprising, for each of the URLs:

automatically determining respective domain name registration information;

comparing the domain name registration information with information regarding a party expected to be associated with the URL; and

determining a degree of correlation between the domain name registration information and the information regarding the party expected to be associated with the URL.

4 . The method of claim 1 , wherein the respective domain name registration information for each URL comprises domain registration age, domain registration contacts, and whether the domain name registration cross signed by a trusted entity.

5 . The method of claim 1 , further comprising:

automatically and at or near real-time, detecting a new URL included in the network traffic; and

adding the new URL to an inventory of the URLs included in the network traffic.

6 . The method of claim 5 , further comprising:

determining respective domain name registration information associated with the new URL;

comparing the domain name registration information with information regarding an intended recipient of transmitted information to be transmitted to the new URL; and

determining a degree of correlation between the domain name registration information and the information regarding the intended recipient of transmitted information to be transmitted to the new URL.

7 . The method of claim 6 , further comprising:

in response to determining the degree of correlation, determining whether a destination associated with the URL is validated; and

in response to determining the destination associated with the URL is not validated, taking a corrective action.

8 . The method of claim 7 , wherein the corrective action comprises ceasing all transmission of data to the new URL.

9 . A computer configured to access a storage device, the computer comprising:

a processor; and

a non-transitory, computer-readable storage medium storing computer-readable instructions that when executed by the processor cause the computer to perform:

analyzing network traffic of an enterprise;

identifying Uniform Resource Locators (URLs) included in the network traffic;

classifying the URLs into a bipartite graph;

establishing classification sets of the bipartite graph;

displaying the classification sets;

in response to displaying the classification sets, receiving an instruction related to management of the network traffic.

10 . The computer product of claim 9 , wherein the instruction comprises an instruction to cease the transmission of data to a plurality of the URLs included in the network traffic.

11 . The computer product of claim 9 , wherein the instructions, when executed by the processor, further cause the computer to perform:

automatically determining respective domain name registration information;

comparing the domain name registration information with information regarding a party expected to be associated with the URL; and

determining a degree of correlation between the domain name registration information and the information regarding the party expected to be associated with the URL.

12 . The computer product of claim 9 , wherein the respective domain name registration information for each URL comprises domain registration age, domain registration contacts, and whether the domain name registration cross signed by a trusted entity.

13 . The computer product of claim 9 , wherein the instructions, when executed by the processor, further cause the computer to perform:

automatically and at or near real-time, detecting a new URL included in the network traffic; and

adding the new URL to an inventory of the URLs included in the network traffic.

14 . The computer product of claim 13 , wherein the instructions, when executed by the processor, further cause the computer to perform:

determining respective domain name registration information associated with the new URL;

comparing the domain name registration information with information regarding an intended recipient of transmitted information to be transmitted to the new URL; and

determining a degree of correlation between the domain name registration information and the information regarding the intended recipient of transmitted information to be transmitted to the new URL.

15 . The computer product of claim 14 , wherein the instructions, when executed by the processor, further cause the computer to perform:

in response to determining the degree of correlation, determining whether a destination associated with the URL is validated; and

in response to determining the destination associated with the URL is not validated, taking a corrective action.

16 . The computer product of claim 15 , wherein the corrective action comprises ceasing all transmission of data to the new URL.

17 . A computer program product, comprising:

a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code comprising:

computer-readable program code configured to analyze network traffic of an enterprise;

computer-readable program code configured to identify Uniform Resource Locators (URLs) included in the network traffic;

computer-readable program code configured to classify the URLs into a bipartite graph;

computer-readable program code configured to establish classification sets of the bipartite graph;

computer-readable program code configured to display the classification sets;

computer-readable program code configured to in response to displaying the classification sets, receive an instruction related to management of the network traffic.

18 . The computer program product of claim 17 , the computer-readable program code further comprising:

computer-readable program code configured to automatically determine respective domain name registration information;

computer-readable program code configured to compare the domain name registration information with information regarding a party expected to be associated with the URL; and

computer-readable program code configured to determining a degree of correlation between the domain name registration information and the information regarding the party expected to be associated with the URL.

19 . The computer program product of claim 19 , the computer-readable program code further comprising:

computer-readable program code configured to automatically and at or near real-time, detect a new URL included in the network traffic; and

computer-readable program code configured to add the new URL to an inventory of the URLs included in the network traffic.

20 . The computer program product of claim 17 , the computer-readable program code further comprising:

computer-readable program code configured to determine respective domain name registration information associated with the new URL;

computer-readable program code configured to compare the domain name registration information with information regarding an intended recipient of transmitted information to be transmitted to the new URL; and

computer-readable program code configured to determine a degree of correlation between the domain name registration information and the information regarding the intended recipient of transmitted information to be transmitted to the new URL.