Interactive display of a confidence-based graph of internet related assets
An inventory of Internet-facing assets related to a target domain is generated using network data gathered from network data sources. Using data sources of known threats, such as malware, phishing attempts, scam pages, blacklisted sites, and so on, a network analytic system generates analytical information about domains, sub-domains, and components that are owned, managed, and/or controlled by a target entity. A confidence score of ownership is generated based on a recursive rule engine. A visual representation of the inventory of Internet-facing assets is generated in a graphical user interface.
1. A method comprising:
receiving entity information associated with a digital footprint request;
retrieving network data associated with the entity information from a network data store based on the entity information;
determining an inventory of Internet-facing assets associated with the entity information;
calculating confidence scores for respective assets in the inventory of the Internet-facing assets associated with the entity information, the confidence scores indicating respective confidence levels that the respective assets are owned, managed, or controlled by an entity based on a measure of connections between the respective assets and other assets in the inventory of the Internet-facing assets; and
generating a force graph representation of the inventory of the Internet-facing assets comprising representations of the confidence scores, which indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity.
2. The method of claim 1 , further comprising:
recursively applying rules of a policy to the Internet-facing assets to determine the measure of the connections between the respective assets and the other assets in the inventory of the Internet-facing assets.
3. The method of claim 1 , wherein the measure of the connections between the respective assets and the other assets in the inventory of the Internet-facing assets is based on at least a domain name, a host, an IP block, an IP address, an ASN, a name server, or a mail server contact.
4. The method of claim 1 , wherein the confidence scores indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity further based on a measure of connections between the respective assets and other assets outside the inventory of the Internet-facing assets.
5. The method of claim 4 , wherein the confidence scores indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity based on a comparison of the measure of the connections between the respective assets and the other assets that are in the inventory of the Internet-facing assets and the measure of the connections between the respective assets and the other assets that are outside the inventory of the Internet-facing assets.
6. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on a domain name associated with the respective asset and a domain name associated with another asset in the inventory of the Internet-facing assets having a same host.
7. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on a domain name associated with the respective asset and a domain name associated with another asset in the inventory of the Internet-facing assets being registered to a contact for the entity.
8. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on a domain name associated with the respective asset and a domain name associated with another asset in the inventory of the Internet-facing assets being associated with a contact email of the entity.
9. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on an IP address associated with the respective asset and an IP address associated with another asset in the inventory of the Internet-facing assets being owned or controlled by an ASN associated with the entity.
10. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on an IP address associated with the respective asset and an IP address associated with another asset in the inventory of the Internet-facing assets being included in an IP block that is hosted by a host that is controlled by the entity.
11. The method of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on a domain name associated with the respective asset and a domain name associated with another asset in the inventory of the Internet-facing assets being controlled by a name server associated with the entity.
12. The method of claim 1 , wherein generating the force graph representation comprises:
generating the force graph representation of the inventory of the Internet-facing assets to include nodes that represent the respective assets such that the nodes have respective sizes that are based on a number of connections the respective assets have with the other assets in the inventory of the Internet-facing assets.
13. The system of claim 1 , wherein a confidence score, which is included in the confidence scores, indicates a respective confidence level that a respective asset is owned, managed, or controlled by the entity based on at least one of:
a relationship between a domain name associated with the respective asset and a domain name associated with another asset in the inventory of the Internet-facing assets;
a relationship between an IP address associated with the respective asset and an IP address associated with another asset in the inventory of the Internet-facing assets.
14. The system of claim 1 , wherein the operations comprise:
generate the force graph representation of the inventory of the Internet-facing assets to comprise nodes that represent the respective assets such that the nodes have respective sizes that are based on a number of connections the respective assets have with the other assets in the inventory of the Internet-facing assets.
15. A system comprising:
a processor; and
a memory storing instructions that, when executed by the processor, perform operations, the operations comprising:
receive entity information associated with a digital footprint request;
retrieve network data associated with the entity information from a network data store based on the entity information;
determine an inventory of Internet-facing assets associated with the entity information;
calculate confidence scores for respective assets in the inventory of the Internet- facing assets associated with the entity information, the confidence scores indicating respective confidence levels that the respective assets are owned, managed, or controlled by an entity based on a measure of connections between the respective assets and other assets in the inventory of the Internet-facing assets; and
generate a force graph representation of the inventory of the Internet-facing assets comprising representations of the confidence scores, which indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity.
16. The system of claim 15 , wherein the operations further comprise:
recursively apply rules of a policy to the Internet-facing assets to determine the measure of the connections between the respective assets and the other assets in the inventory of the Internet-facing assets.
17. The system of claim 15 , wherein the measure of the connections between the respective assets and the other assets in the inventory of the Internet-facing assets is based on at least a domain name, a host, an IP block, an IP address, an ASN, a name server, or a mail server contact.
18. The system of claim 15 , wherein the confidence scores indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity further based on a measure of connections between the respective assets and other assets outside the inventory of the Internet-facing assets.
19. The system of claim 18 , wherein the confidence scores indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity based on a comparison of the measure of the connections between the respective assets and the other assets that are in the inventory of the Internet-facing assets and the measure of the connections between the respective assets and the other assets that are outside the inventory of the Internet-facing assets.
20. A non-transitory computer-readable storage medium storing instructions that, when executed, cause a processor-based system to perform operations, the operations comprising:
receiving entity information associated with a digital footprint request;
retrieving network data associated with the entity information from a network data store based on the entity information;
determining an inventory of Internet-facing assets associated with the entity information;
calculating confidence scores for respective assets in the inventory of the Internet-facing assets associated with the entity information, the confidence scores indicating respective confidence levels that the respective assets are owned, managed, or controlled by an entity based on a measure of connections between the respective assets and other assets in the inventory of the Internet-facing assets; and
generating a force graph representation of the inventory of the Internet-facing assets comprising representations of the confidence scores, which indicate the respective confidence levels that the respective assets are owned, managed, or controlled by the entity.