Systems, devices, and methods for detecting and mitigating domain name registrations used for malicious behavior

1. A method for detecting a domain name that is associated with malicious behavior, comprising:

receiving domain data for a plurality of domain names comprising a first domain name and a plurality of similar domain names, wherein the plurality of similar domain names are previously determined to be associated with proper behavior, and wherein the plurality of similar domain names share a pattern with the first domain name, wherein the domain data comprises a first attribute and a second attribute of the first domain name and the similar domain names;

comparing the first attribute of the first domain name to the first attributes of the similar domain names to produce a first value;

comparing the second attribute of the first domain name to the second attributes of the similar domain names to produce a second value;

combining the first value and the second value to produce a combined value;

determining a likelihood that the first domain name is associated with malicious behavior based on the combined value; and

performing a remedial action when the likelihood is greater than a predetermined value, wherein the remedial action is selected from the group consisting of: ceasing to process a request from the first domain name, sending an alert to a network operations controller that instigates reconfiguration of network hardware to block access by the first domain name to a server, setting up or reconfiguring a router or firewall rule to block a request from the first domain name, or a combination thereof.

2. The method of claim 1 , wherein the domain data is received from a registry or a registrar.

3. The method of claim 2 , wherein the first attribute is different at the registry and the registrar.

4. The method of claim 1 , wherein the second attribute of the first domain name is selected from the group consisting of a use of the first domain name, a registration pattern of the first domain name, a query pattern of the first domain name, a reputation score of the first domain name, or a combination thereof.

5. The method of claim 1 , further comprising:

assigning a first weight to the first value to produce a first weighted value; and

assigning a second weight to the second value to produce a second weighted value, wherein the first and second weights are selected based upon historical data of malicious behavior and benign behavior.

6. The method of claim 5 , wherein combining the first value and the second value comprises combining the first weighted value and the second weighted value.

7. The method of claim 1 , wherein combining the first value and the second value comprises using a logistic regression, a linear regression, or both to produce the combined value.

8. A system comprising:

a processing system comprising one or more processors; and

a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions that, when executed by the processing system, cause the processing system to perform operations comprising:

receiving domain data for a plurality of domain names comprising a first domain name and a plurality of similar domain names, wherein the plurality of similar domain names are previously determined to not be associated with malicious behavior, and wherein the plurality of domain name share a pattern with the first domain name, wherein the domain data comprises a first attribute and a second attribute of the first domain name and the similar domain names;

comparing the first attribute of the first domain name to the first attributes of the similar domain names to produce a first value;

comparing the second attribute of the first domain name to the second attributes of the similar domain names to produce a second value;

combining the first value and the second value to produce a combined value;

determining a likelihood that the first domain name is associated with malicious behavior based on the combined value; and

performing a remedial action when the likelihood is greater than a predetermined value, wherein the remedial action is selected from the group consisting of: ceasing to process a request from the first domain name, sending an alert to a network operations controller that instigates reconfiguration of network hardware to block access by the first domain name to a server, setting up or reconfiguring a router or firewall rule to block a request from the first domain name, or a combination thereof.

9. The system of claim 8 , wherein the domain data is received from a registry or a registrar.

10. The system of claim 9 , wherein the first attribute is different at the registry and the registrar.

11. The system of claim 8 , wherein the second attribute of the first domain name is selected from the group consisting of a use of the first domain name, a registration pattern of the first domain name, a query pattern of the first domain name, a reputation score of the first domain name, and a combination thereof.

12. The system of claim 8 , further comprising:

assigning a first weight to the first value to produce a first weighted value; and

assigning a second weight to the second value to produce a second weighted value, wherein the first and second weights are selected based upon historical data of malicious behavior and benign behavior.

13. The system of claim 8 , wherein combining the first value and the second value comprises combining the first weighted value and the second weighted value.

14. The system of claim 8 , wherein combining the first value and the second value comprises using logistic regression, a linear regression, or both to produce the combined value.

15. The system of claim 1 , wherein the pattern comprises a linguistic pattern or a structural pattern.