Techniques for detecting domain threats
An inventory of Internet-facing assets related to a username within a social media site is generated using network data gathered from network data sources. Using data sources of known threats, such as malware, phishing attempts, scam pages, blacklisted sites, and so on, a network analytic system generates analytical information about components that are owned, managed, and/or controlled by a target entity. A measure of identity threat is generated based on a classification model using the analytical information.
1. A method comprising, at a computer system:
monitoring network data from one or more data sources;
based on detecting, in the network data, a network event related to a username within a social media site:
identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
generating, by converting from a first format of the identifier, a converted identifier having a second format;
determining one or more words associated with the identity of the entity;
determining a measure of similarity of the converted identifier to each of the one or more words associated with the identity of the entity;
determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity;
generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source; and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
2. The method of claim 1 , further comprising:
detecting, in the network data, a first occurrence of the network event; and
determining that the identifier is one of: a corporate functional term appended to the identity of the entity, or a keyword associated with one or more trademark identifiers associated with a brand of the entity appended to the identity of the entity.
3. The method of claim 1 , wherein generating the converted identifier includes decoding the identifier from the first format that is encoded by Punycode, wherein the converted identifier is generated based on mapping the decoded identifier to the converted identifier, wherein the decoded identifier is mapped to the converted identifier based on one or more mappings, wherein each of the one or more mappings is for one or more homoglyphs in the decoded identifier to one or more ASCII equivalents, and wherein the converted identifier is based at least in part on the one or more ASCII equivalents for the one or more mappings.
4. The method of claim 1 , wherein the measure of similarity is determined based on computing a similarity distance for each of the one or more words compared to the converted identifier.
5. The method of claim 1 , wherein the data source includes a repository of known words.
6. The method of claim 1 , wherein the one or more words associated with the identity of the entity includes one or more trademark identifiers associated with a brand of the entity.
7. The method of claim 6 , wherein the data source is a first data source, and wherein determining the one or more words associated with the identity of the entity includes accessing the one or more words from a second data source.
8. The method of claim 1 , wherein the data source is a first data source, wherein the measure is a first measure, and wherein the method further comprises:
computing a second measure of the network threat to the identity of the entity based on assessing the plurality of terms using a second data source; and
determining, based on the first measure and the second measure, a third measure of the network threat to the identity of the entity.
9. The method of claim 8 , wherein the second data source includes one of: a repository of malicious names, a repository of classifications for a brand, or a repository of corporate functional words for the brand.
10. The method of claim 1 , wherein the data source is a first data source, and wherein the measure of the network threat may be computed using a second data source.
11. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
monitoring network data from one or more data sources;
based on detecting, in the network data, a network event related to a username within a social media site:
identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
generating, by converting from a first format of the identifier, a converted identifier having a second format;
determining one or more words associated with the identity of the entity;
determining a measure of similarity of the converted identifier to each of the one or more words associated with the identity of the entity;
determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity;
generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source; and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
12. The one or more non-transitory computer-readable storage media of claim 11 , which when executed by the one or more processors cause further performance of:
detecting, in the network data, a first occurrence of the network event; and
determining that the identifier is one of: a corporate functional term appended to the identity of the entity, or a keyword associated with one or more trademark identifiers associated with a brand of the entity appended to the identity of the entity.
13. The one or more non-transitory computer-readable storage media of claim 11 , wherein generating the converted identifier includes decoding the identifier from the first format that is encoded by Punycode, wherein the converted identifier is generated based on mapping the decoded identifier to the converted identifier, wherein the decoded identifier is mapped to the converted identifier based on one or more mappings, wherein each of the one or more mappings is for one or more homoglyphs in the decoded identifier to one or more ASCII equivalents, and wherein the converted identifier is based at least in part on the one or more ASCII equivalents for the one or more mappings.
14. The one or more non-transitory computer-readable storage media of claim 11 , wherein the measure of similarity is determined based on computing a similarity distance for each of the one or more words compared to the converted identifier.
15. The one or more non-transitory computer-readable storage media of claim 11 , wherein the data source is a first data source, wherein the measure is a first measure, and which when executed by the one or more processors cause further performance of:
computing a second measure of the network threat to the identity of the entity based on assessing the plurality of terms using a second data source; and
determining, based on the first measure and the second measure, a third measure of the network threat to the identity of the entity.
16. A system, comprising:
one or more computing processors;
one or more non-transitory computer readable media storing a program of instructions that is executable by the one or more computing processors to perform:
monitoring network data from one or more data sources;
based on detecting, in the network data, a network event related to a username within a social media site:
identifying, in the network data, an identifier associated with the network event to assess a network threat to an identity of an entity;
generating, by converting from a first format of the identifier, a converted identifier having a second format;
determining one or more words associated with the identity of the entity;
determining a measure of similarity of the converted identifier to each of the one or more words associated with the identity of the entity;
determining the measure of similarity satisfies a threshold for assessing the network threat to the identity of the entity; generating a set of terms by parsing the converted identifier using a plurality of terms obtained from a data source; and computing, using a classification model, a measure of the network threat to the identity of the entity based on a relationship of the set of terms, wherein the relationship of the set of terms is determined as a value based on each uniquely weighted term of the set of terms, and wherein the measure of the network threat is based in part on the value of the relationship of the set of terms.
17. The system of claim 16 , which when executed by the one or more processors cause further performance of:
detecting, in the network data, a first occurrence of the network event; and
determining that the identifier is one of: a corporate functional term appended to the identity of the entity, or a keyword associated with one or more trademark identifiers associated with a brand of the entity appended to the identity of the entity.
18. The system of claim 16 , wherein generating the converted identifier includes decoding the identifier from the first format that is encoded by Punycode, wherein the converted identifier is generated based on mapping the decoded identifier to the converted identifier, wherein the decoded identifier is mapped to the converted identifier based on one or more mappings, wherein each of the one or more mappings is for one or more homoglyphs in the decoded identifier to one or more ASCII equivalents, and wherein the converted identifier is based at least in part on the one or more ASCII equivalents for the one or more mappings.
19. The system of claim 16 , wherein the measure of similarity is determined based on computing a similarity distance for each of the one or more words compared to the converted identifier.
20. The system of claim 16 , wherein the data source is a first data source, wherein the measure is a first measure, and which when executed by the one or more processors cause further performance of:
computing a second measure of the network threat to the identity of the entity based on assessing the plurality of terms using a second data source; and
determining, based on the first measure and the second measure, a third measure of the network threat to the identity of the entity.