SYSTEMS AND METHODS FOR TOP-LEVEL DOMAIN ANALYSIS
A system may be configured to identify a Person of Interest by analyzing top level domains. Some implementations may include receiving a target top-level domain (TLD) (e.g., originating from a geographic area of interest). A network packet of internet traffic may be captured and it may be determined that a destination port of the captured network traffic is an open port. A counter may be incremented based on the determined open port and/or determining a payload of the network packet comprises an expression matching the target TLD. An alert associated with the target TLD may be transmitted based on determining the counter exceeds a threshold. The internet traffic may be disrupted based on determining the counter exceeds a threshold.
1 . A computer program product comprising:
a computer-readable storage medium; and
instructions stored on the computer-readable storage medium that, when executed by a processor, causes the processor to:
receive a target top-level domain (TLD);
capture a network packet of internet traffic;
determine a destination port of the captured network packet is an open port;
increment, based on the determined open port and determining a payload of the network packet comprises an expression matching the target TLD, a counter; and
transmit, based on determining the counter exceeds a threshold, an alert associated with the target TLD.
2 . The computer-readable medium product of claim 1 , wherein the destination port is determined based on a Transmission Control Protocol/Internet Protocol (TCP/IP) Transport Layer (Layer 4) of the network packet.
3 . The computer program product of claim 1 , wherein the instructions further cause the processer to generate a log entry associated with the network packet.
4 . The computer program product of claim 1 , wherein the instructions further cause the processer to disrupt, based on determining the counter exceeds a threshold, the internet traffic.
5 . The computer program product of claim 1 , wherein the destination port is associated with encrypted traffic and the expression comprises a name field.
6 . The computer program product of claim 1 , wherein the destination port is associated with domain name system (DNS) queries and the expression comprises a server name indication.
7 . The computer program product of claim 1 , wherein the target TLD is received from a database.
8 . The computer program product of claim 1 , wherein the TLD originates from a geographic area of interest.
9 . A system comprising:
one or more processors; and
memory including instructions that, when executed by the one or more processors, cause the system to:
receive a target top-level domain (TLD);
capture a network packet of internet traffic;
determine a destination port of the captured network packet is an open port;
determine, based on the determined open port, a payload of the network packet comprises an expression matching the target TLD; and
transmit, based the expression matching the target TLD, an alert associated with the target TLD.
10 . The system of claim 9 , wherein the destination port is determined based on a Transmission Control Protocol/Internet Protocol (TCP/IP) Transport Layer (Layer 4) of the network packet.
11 . The system of claim 9 , wherein the instructions further cause the system to generate a log entry associated with the network packet.
12 . The system of claim 9 , wherein the instructions further cause the system to disrupt, based on the expression matching the target TLD, the internet traffic.
13 . The system of claim 9 , wherein the destination port is associated with encrypted traffic and the expression comprises a name field.
14 . The system of claim 9 , wherein the destination port is associated with domain name system (DNS) queries and the expression comprises a server name indication.
15 . The system of claim 9 , wherein the target TLD is received from a database.
16 . The system of claim 9 , wherein the TLD originates from a geographic area of interest.
17 . A method comprising:
receiving a target top-level domain (TLD);
capturing a network packet of internet traffic;
determining, based on determining a destination port of the captured network packet is an open port, a payload of the network packet comprises an expression matching the target TLD; and
incrementing, based on the expression matching the target TLD, a counter;
determining the counter exceeds a threshold;
transmitting, based on the counter exceeding the threshold, an alert associated with the target TLD.
18 . The method of claim 17 , wherein the destination port is determined based on a Transmission Control Protocol/Internet Protocol (TCP/IP) Transport Layer (Layer 4) of the network packet.
19 . The method of claim 17 , wherein the destination port is associated with encrypted traffic and the expression comprises a name field.
20 . The method of claim 17 , wherein the destination port is associated with domain name system (DNS) queries and the expression comprises a server name indication.