Systems and methods for dynamic vendor and vendor outlet classification

• US 10,643,259 B2
• Filed: 08/24/2017
• Issued: 05/05/2020
• Est. Priority Date: 03/22/2007
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Baccas, Paul Oliver, McCourt, William James
• Primary Examiner(s): McCormick, Gabrielle A
• Application Number:
  US15/685,039
• Publication Number:
  US 20180005284A1
• Time in Patent Office: 985 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06Q 30/0282 Rating or review of business operators or products
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Certain embodiments of the present invention provide methods and systems for dynamic classification of electronic vendors. Certain embodiments provide a method for dynamic vendor classification. The method includes analyzing a vendor based on a comparison of vendor features; categorizing the vendor based on the analysis; and permitting access to the vendor according to the categorization of the vendor. The categorization may include trusted, not trusted, or unsure, for example. Analysis may include comparing a first outlet of the vendor with a second outlet of the vendor, for example. Analysis may include comparing an outlet of the vendor with an outlet of a second vendor, for example. A vendor may be defined as a particular outlet for a vendor and/or all outlets associated with a vendor (a vendor entity).

Claims

1. A method for dynamic vendor classification, said method comprising:

receiving website content from each website of a plurality of websites at a dynamic vendor classification system, wherein the website content represents at least a portion of each website of the plurality of websites, forming a plurality of website content;

normalizing the plurality of website content based upon at least one of hypertext markup language tags, encoded content, or a visual comparison of screen shots for each one of the plurality of website content, thereby providing normalized content;

analyzing the normalized content using a processor to identify the normalized content as congruent when the normalized content is at least 90% the same, to identify the normalized content as similar when the normalized content is less than 90% the same and is greater than 60% the same, and to identify the normalized content as different when the normalized content is less than 60% the same, thereby providing a plurality of categorized websites categorized by similarity;

storing the plurality of categorized websites, each categorized website having a category of similarity relative to at least one other one of the plurality of categorized websites, in a library, along with sets of rules to be used depending upon the category of similarity;

receiving a request from a customer to access a first website of the plurality of websites at a dynamic vendor classification module of the dynamic vendor classification system;

in response to receiving the request, based on the plurality of categorized websites already stored, determining whether a vendor of the first website is trusted, not trusted, or uncertain using a stored category of similarity of the first website relative to a second website of the plurality of websites, wherein determining whether the vendor of the first website is trusted, not trusted, or uncertain includes using a first set of rules from the sets of rules when the stored category of similarity of the first website relative to the second website indicates that the first website is congruent to the second website and using a second set of rules from the sets of rules when the stored category of similarity of the first website relative to the second website indicates that the first website is similar to the second website, the second set of rules for similar websites including at least one rule for comparing a language and a hosting location; and

when the vendor of the first website is categorized as uncertain, flagging the vendor for monitoring to gather additional information for a trust analysis.

2. The method of claim 1, further comprising controlling access to the first website by the customer based upon whether the vendor is trusted, not trusted, or uncertain.

3. The method of claim 1, further comprising permitting access to the vendor according to whether the vendor is trusted, not trusted, or uncertain.

4. The method of claim 1, wherein analyzing further comprises comparing first outlet of the vendor with second outlet of a second vendor.

5. The method of claim 1, wherein analyzing the normalized content using the processor includes determining, based on data size, data components, number of data components, and Domain Name Server (DNS) data, whether content is congruent.

6. The method of claim 1, wherein analyzing the normalized content using the processor includes determining, based on different number of data components, whether content is similar.

7. A set of instructions for execution on a computer and embodied in a non-transitory computer-readable medium, the set of instructions comprising code that performs the steps of:

receiving website content from each website of a plurality of websites at a dynamic vendor classification system, wherein the website content represents at least a portion of each website of the plurality of websites, forming a plurality of website content;

normalizing the plurality of website content based upon at least one of hypertext markup language tags, encoded content, or a visual comparison of screen shots for each one of the plurality of website content, thereby providing normalized content;

analyzing the normalized content using a processor to identify the normalized content as congruent when the normalized content is at least a first percentage the same, to identify the normalized content as similar when the normalized content is less than the first percentage the same and is greater than a second percentage the same, and to identify the normalized content as different when the normalized content is less than the second percentage the same, thereby providing a plurality of categorized websites categorized by similarity;

storing the plurality of categorized websites, each categorized website having a category of similarity relative to at least one other one of the plurality of categorized websites, in a library, along with sets of rules to be used depending upon the category of similarity;

receiving a request from a customer to access a first website of the plurality of websites at a dynamic vendor classification module of the dynamic vendor classification system;

in response to receiving the request, based on the plurality of categorized websites already stored, determining whether a vendor of the first website of the plurality of websites is uncertain when the first website of the plurality of websites is in a grey zone that is neither trusted nor untrusted using a stored category of similarity of the first website relative to a second website of the plurality of websites, wherein determining whether the vendor of the first website is uncertain includes using a first set of rules from the sets of rules when the stored category of similarity of the first website relative to the second website indicates that the first website is congruent to the second website and using a second set of rules from the sets of rules when the stored category of similarity of the first website relative to the second website indicates that the first website is similar to the second website, the second set of rules for similar websites including at least one rule for comparing a language and a hosting location; and

in response to categorizing the vendor as uncertain, flagging the vendor for monitoring to gather additional information for a trust analysis.

8. The non-transitory computer-readable medium of claim 7 further comprising code that performs the step of controlling access to the first website of the plurality of websites by the customer based upon whether the vendor is trusted, not trusted, or uncertain.

9. The non-transitory computer-readable medium of claim 7 further comprising code that performs the step of permitting access to the vendor according to whether the vendor is trusted, not trusted, or uncertain.

10. The non-transitory computer-readable medium of claim 7, wherein analyzing further comprises comparing first outlet of the vendor with a second outlet of a second vendor.

11. The non-transitory computer-readable medium of claim 7, wherein analyzing the normalized content using the processor includes determining, based on data size, data components, number of data components, and Domain Name Server (DNS) data, whether content is congruent.

12. The non-transitory computer-readable medium of claim 7, wherein analyzing the normalized content using the processor includes determining, based on different number of data components, whether content is similar.

13. The non-transitory computer-readable medium of claim 7, wherein the first percentage is 90%, and wherein the second percentage is 60%.