METHODS AND SYSTEMS FOR ANALYZING DATA RELATED TO POSSIBLE ONLINE FRAUD

• US 20090064330A1
• Filed: 11/03/2008
• Published: 03/05/2009
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Granted Patent: US 9,026,507 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 12/1813 for computer conferences, e.g. chat rooms instant messaging H04L51/04; protocols for multimedia communication H04L65/1101; arrangements for multi-party communication H04L65/403; telephonic conference arrangements H04M3/56; television conference systems H04N7/15
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Various embodiments of the invention provide methods, systems and software for analyzing data. In particular embodiments, for example, a set of data about a web site may be analyzed to determine whether the web site is likely to be illegitimate (e.g., to be involved in a fraudulent scheme, such as a phishing scheme, the sale of gray market goods, etc.). In an exemplary embodiment, a set of data may be divided into a plurality of components (each of which, in some cases, may be considered a separate data set). Merely by way of example, a set of data may comprise data gathered from a plurality of data sources, and/or each component may comprise data gathered from one of the plurality of data sources. As another example, a set of data may comprise a document with a plurality of sections, and each component may comprise one of the plurality of sections. Those skilled in the art will appreciate that the analysis of a particular component may comprise certain tests and/or evaluations, and that the analysis of another component may comprise different tests and/or evaluations. In other cases, the analysis of each component may comprise similar tests and/or evaluations. The variety of tests and/or evaluations generally will be implementation specific.

Claims

1-80. -80. (canceled)

81. A system, comprising:

means for analyzing a uniform resource locator (“

URL”

) referencing a web site, wherein the web site comprises a web page;

means for analyzing a server hosting the web site;

means for analyzing the web page; and

based on the analysis of the URL referencing the web site, the analysis of the server hosting the web site, and the analysis of the web page, means for categorizing the web site as a possibly fraudulent web site.

82. A method, comprising:

accessing, with a computer, a set of data related to a web site;

dividing, with the computer, the set of data into a plurality of components, one of the plurality of components comprising an Internet Protocol (“

IP”

) address associated with the web site;

analyzing at least one of the components, wherein analyzing at least one of the components comprises;

identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

comparing the IP address of the web site with the IP block assigned to the proper domain;

assigning scores to at least some of the analyzed components; and

categorizing the web site as a possibly fraudulent web site, based at least in part on one or more of the scores.

83. A method as recited in claim 82, wherein the set of data comprises a newsgroup posting.

84. A method as recited in claim 82, wherein the set of data comprises a web page.

85. A method as recited in claim 82, wherein the set of data comprises a transcript from an Internet chat session.

86. A method as recited in claim 82, wherein the set of data comprises an email message.

87. A method as recited in claim 86, wherein the plurality of components further comprises:

a header portion of the email message;

a body portion of the email message; and

a uniform resource locator (“

URL”

) incorporated within the body portion of the email message, the URL referring to a web site.

88. A method as recited in claim 86, wherein accessing the set of data comprises receiving the email message.

89. A method as recited in claim 82, wherein the set of data comprises a set of data about a server hosting the web site.

90. A method as recited in claim 89, wherein accessing the set of data comprises interrogating the web site.

91. A method, comprising:

performing, with a computer, a plurality of tests on a web site, wherein one of the tests comprises;

accessing a set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site;

identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

comparing the IP address of the web site with the IP block assigned to the proper domain;

assigning a score based on each of the plurality of tests;

assigning a composite score to the web site based on the scores for each of the plurality of tests; and

categorizing the web site based at least in part on the composite score.

92. A method as recited in claim 91, wherein at least one of the plurality of tests relates to the content of the web site.

93. A method as recited in claim 91, wherein performing a plurality of tests comprises:

analyzing a set of WHOIS information for a domain associated with the web site.

94. A method as recited in claim 91, wherein performing a plurality of tests comprises:

searching a source of anti-abuse information for information about the web site.

95. A method as recited in claim 91, wherein performing a plurality of tests comprises:

determining the geographical location of a server hosting the web site.

96. A method as recited in claim 91, wherein performing a plurality of tests comprises:

assessing whether a server hosting the web site implements secured protocols.

97. A method as recited in claim 91, wherein performing a plurality of tests comprises:

verifying a set of active ports on a server hosting the web site.

98. A method as recited in claim 91, wherein performing a plurality of tests comprises:

downloading a web page from the web site.

99. A method as recited in claim 98, wherein performing a plurality of tests comprises:

analyzing the web page to determine whether the web page implements an online form.

100. A method as recited in claim 99, wherein performing a plurality of tests comprises:

analyzing an online form to determine whether the online form requests personal information from a user.

101. A method as recited in claim 98, wherein performing a plurality of tests comprises:

analyzing the web page for errors in spelling or grammar.

102. A method as recited in claim 98, wherein performing a plurality of tests comprises:

identifying a uniform resource locator (“

URL”

) on the web page; and

analyzing the identified URL to determine whether the identified URL references resources external to the web site.

103. A method as recited in claim 102, wherein the resources external to the web site comprise a resource selected from a group consisting of an image hosted by a legitimate web site and a web page hosted by a legitimate web site.

104. A method as recited in claim 98, wherein performing a plurality of tests comprises:

generating a representation of the web page.

105. A method as recited in claim 104, wherein performing a plurality of tests comprises:

comparing the representation of the web page with a stored representation of a web page.

106. A method as recited in claim 104, wherein the representation of the web site comprises a hash value calculated from the web page.

107. A method as recited in claim 104, wherein the representation of the web site comprises a checksum calculated from the web page.

108. A method, comprising:

accessing, with a computer, a domain registration record associated with an Internet domain;

performing a plurality of tests with respect to the domain, wherein one of the plurality of tests comprises;

identifying a web site associated with the domain;

identifying an Internet Protocol (“

IP”

) address associated with the web site;

identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

comparing the IP address of the web site with the IP block assigned to the proper domain;

for each of the plurality of tests, assigning a score to the domain, such that a plurality of scores are assigned to the domain;

categorizing the domain as a possibly illegitimate domain, based at least in part on one or more of the plurality of scores.

109. A method as recited in claim 108, wherein performing a plurality of tests comprises performing at least one test on a server hosting a web site associated with the domain.

110. A method as recited in claim 108, wherein performing a plurality of tests with respect to the domain comprises evaluating an owner of the domain.

111. A method as recited in claim 110, wherein performing a plurality of tests with respect to the domain comprises comparing an owner of the domain with an owner of a trademark similar to a name of the domain.

112. A method as recited in claim 108, wherein performing a plurality of tests with respect to the domain comprises evaluating a set of WHOIS information associated with the domain.

113. A method as recited in claim 108, wherein performing a plurality of tests with respect to the domain comprises evaluating a set of domain name system (“

DNS”

) information associated with the domain.

114. A method as recited in claim 108, wherein performing a plurality of tests with respect to the domain comprises analyzing a web site associated with the domain.

115. A method, comprising:

identifying an Internet Protocol (“

IP”

) address of a web site;

identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an IP block assigned to the proper domain; and

comparing the IP address of the web site with the IP block assigned to the proper domain;

categorizing the web site as a possibly fraudulent web site, based at least in part on a comparison of the IP address of the web site with the IP block assigned to the proper domain.

116. A computer system, comprising a processor and a set of instructions executable by the processor, the set of instructions comprising:

instructions for accessing a set of data related to a web site;

instructions for dividing the set of data into a plurality of components, one of the plurality of components comprising an Internet Protocol (“

IP”

) address associated with the web site;

instructions for analyzing at least one of the components, wherein the instructions for analyzing at least one of the components comprises;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning scores to at least some of the analyzed components; and

instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on one or more of the scores.

117. A computer system, comprising a processor and a set of instructions executable by the processor, the set of instructions comprising:

instructions for performing a plurality of tests on a web site, wherein the instructions for performing one of the tests comprise;

instructions for accessing a set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning a score based on each of the plurality of tests;

instructions for assigning a composite score to the web site based on the scores for each of the plurality of tests; and

instructions for categorizing the web site based at least in part on the composite score.

118. A computer system, comprising a processor and a set of instructions executable by the processor, the set of instructions comprising:

instructions for accessing, with a computer, a domain registration record associated with an Internet domain;

instructions for performing a plurality of tests with respect to the domain, wherein the instructions for performing one of the plurality of tests comprise;

instructions for identifying a web site associated with the domain;

instructions for identifying an Internet Protocol (“

IP”

) address associated with the web site;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning, for each of the plurality of tests, a score to the domain, such that a plurality of scores are assigned to the domain;

instructions for categorizing the domain as a possibly illegitimate domain, based at least in part on one or more of the plurality of scores.

119. A software program embodied on a computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for accessing a set of data related to a web site;

instructions for dividing the set of data into a plurality of components, one of the plurality of components comprising an Internet Protocol (“

IP”

) address associated with the web site;

instructions for analyzing at least one of the components, wherein the instructions for analyzing at least one of the components comprises;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning scores to at least some of the analyzed components; and

instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on one or more of the scores.

120. A software program embodied on a computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for performing a plurality of tests on a web site, wherein the instructions for performing one of the tests comprise;

instructions for accessing a set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning a score based on each of the plurality of tests;

instructions for assigning a composite score to the web site based on the scores for each of the plurality of tests; and

instructions for categorizing the web site based at least in part on the composite score.

121. A software program embodied on a computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for accessing, with a computer, a domain registration record associated with an Internet domain;

instructions for performing a plurality of tests with respect to the domain, wherein the instructions for performing one of the plurality of tests comprise;

instructions for identifying a web site associated with the domain;

instructions for identifying an Internet Protocol (“

IP”

) address associated with the web site;

instructions for identifying a proper domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the proper domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the proper domain;

instructions for assigning, for each of the plurality of tests, a score to the domain, such that a plurality of scores are assigned to the domain;

instructions for categorizing the domain as a possibly illegitimate domain, based at least in part on one or more of the plurality of scores.