METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCTS FOR RECOGNISING, VALIDATING AND CORRELATING ENTITIES IN A COMMUNICATIONS DARKNET

• US 20190317968A1
• Filed: 12/16/2016
• Published: 10/17/2019
• Est. Priority Date: 12/16/2016
• Status: Active Application

• Current Assignee: Telefónica Cybersecurity Tech SL
• Original Assignee: Telefonica Digital Espana, S.L.U. (Telefonica SA)
• Inventors: DE LOS SANTOS VILCHEZ, Sergio, TORRANO GIMENEZ, Carmen, BIANZINO, Aruna Prem
• Application Number:
  US16/469,864
• Publication Number:
  US 20190317968A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The method according to the invention comprises the steps of: identifying one or more entities (21) located in a darknet (50) taking into consideration information relative to network domains thereof, and collecting information of said one or more entities (21) identified; extracting a series of metadata from the information collected from said one or more entities (21) identified; validating said one or more identified entities (21) with information from a surface network (51), said information coming from a surface network (51) associated with the information collected from the identified entities (21); and generating a profile of each identified entity (21) by correlating the validated information of each entity (21) with data and metadata from said surface network (51).

Claims

1. A method for recognising, validating and correlating entities in a communications darknet, the method being characterised in that it comprises:

a computing system identifying one or more entities located in a darknet taking into consideration information relative to network domains of the darknet, and collecting information of said one or more entities identified;

said computing system extracting a series of metadata from the information collected from said one or more entities identified;

said computing system validating said one or more identified entities with information from a surface network, said information coming from a surface network associated with the information collected from the identified entities; and

said computing system automatically generating a profile of each identified entity by correlating the validated information of each entity with data and metadata from said surface network.

2. The method according to claim 1, wherein said information collected from said one or more identified entities, prior to said validating, is stored in a memory or database of the computing system, and wherein said information from the surface network including data and metadata is also stored in the memory or database.

3. The method according to claim 1, which method further comprises:

checking if the information collected from a given entity and the series of metadata extracted from said given entity coincide with a list of keywords generated from data acquired from public lists and/or from reports generated by said operators specialising in interventions and/or security analysts; and

said computing system generating an alert if a result of said check indicates that the check has been positive.

4. The method according to claim 1, wherein said correlation is performed furthermore taking into consideration validated information of the other identified entities.

5. The method according to claim 1, which method further comprises mapping at least some of the identified entities with a series of users, services, and/or places identified in the surface network.

6. The method according to claim 1, wherein the information collected from said one or more identified entities includes at least one plain text file containing the description of the contents of a web page on the darknet, a plain text file containing scripts executed on the darknet, a plain text file containing the description of the graphic design of a web page on the darknet, headers, documents and/or files made or exchanged on the darknet and/or through a real-time text-based communication protocol used on the darknet.

7. The method according to claim 1, wherein the information from the surface network includes at least one network domain registered with the same name as a network domain of the darknet, a user name registered in another network domain, or an e-mail address registered in another network domain.

8. The method according to claim 1, wherein the information collected from said one or more identified entities comprises documents and/or files made or exchanged on the darknet including multimedia content, which method comprises filtering said multimedia content according to compliance and privacy policies and preventively deactivates the multimedia content if said compliance and privacy policies are met.

9. The method according to claim 1, wherein the information collected from said one or more entities includes user name and password fields indicative of the presence of information with restricted access, which method comprises creating an account in said one or more entities, associating a password with said created account, validating the created user, and executing access to the information with restricted access.

10. The method according to claim 1, which method further comprises showing said generated profile or profiles through a display unit for later use by operators specialising in interventions in communication networks and/or communication network security analysts.

11. The method according to claim 1, which method further comprises sending said generated profile or profiles to a remote computing device for later use through a user interface by operators specialising in interventions in communication networks and/or communication network security analysts for later analysis of said one or more identified entities.

12. The method according to claim 1, wherein said one or more entities comprise services, applications, and/or users located in said darknet.

16. A computer program product including computer-readable code instructions which, when executed in at least one processor of a computing system, implement a method according to claim 1.

13. A system for recognising, validating and correlating entities of a darknet, which system comprises:

a darknet adapted for allowing an anonymous communication of one or more entities (21) through it;

a surface network; and

a computing system operatively connected with said darknet and with said surface network and including one or more processing units adapted and configured for;

identifying said one or more entities located on the darknet taking into consideration information relative to network domains of the darknet and collecting information of said one or more entities identified;

extracting a series of metadata from the information collected from said one or more entities identified;

validating said one or more identified entities with information from the surface network, wherein said information from the surface network is associated with the information collected from the identified entities; and

automatically generating a profile of each identified entity by at least correlating the validated information of each entity with data and metadata from said surface network.

14. The system according to claim 13, which method further comprises a memory or database for at least storing said information collected from said one or more identified entities and said information from the surface network including the data and metadata.

15. The system according to claim 13, wherein said one or more entities comprise services, applications, and/or users located in said darknet.