Methods and systems for analyzing data related to possible online fraud

• US 9,356,947 B2
• Filed: 04/07/2015
• Issued: 05/31/2016
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: Thomson Reuters Global Resources
• Inventors: Shraim, Ihab, Shull, Mark
• Primary Examiner(s): WILSON, KIMBERLY LOVEL
• Application Number:
  US14/680,918
• Publication Number:
  US 20150237061A1
• Time in Patent Office: 420 Days
• Field of Search: 707/694, 707/697, 726/22, 726/26
• US Class Current: 1/1
• CPC Class Codes: H04L 12/1813 for computer conferences, e.g. chat rooms instant messaging H04L51/04; protocols for multimedia communication H04L65/1101; arrangements for multi-party communication H04L65/403; telephonic conference arrangements H04M3/56; television conference systems H04N7/15
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Various embodiments of the invention provide methods, systems and software for analyzing data. In particular embodiments, for example, a set of data about a web site may be analyzed to determine whether the web site is likely to be illegitimate (e.g., to be involved in a fraudulent scheme, such as a phishing scheme, the sale of gray market goods, etc.). In an exemplary embodiment, a set of data may be divided into a plurality of components (each of which, in some cases, may be considered a separate data set). Merely by way of example, a set of data may comprise data gathered from a plurality of data sources, and/or each component may comprise data gathered from one of the plurality of data source. As another example, a set of data may comprise a document with a plurality of sections, and each component may comprise one of the plurality of sections. Those skilled in the art will appreciate that the analysis of another component may comprise certain tests and/or evaluations, and that the analysis of another component may comprise different tests and/or evaluations. In other cases, the analysis of each component may comprise similar tests and/or evaluations. The variety of tests and/or evaluations generally will be implementation specific.

Claims

1. A method, comprising:

periodically collecting, with a computer, from a plurality of different sources, a set of data related to a web site, wherein the set of data comprises a web page on the web site;

dividing, with the computer, the set of data into a plurality of components, the plurality of components including at least an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

analyzing at least two of the components, wherein analyzing the at least two of the plurality of components comprises;

analyzing the text of the body field to identify at least one of a pre-defined blacklisted term and a brand name;

identifying a domain of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

comparing the IP address of the web site with the IP block assigned to the domain;

assigning at least one score to one or more of the analyzed components; and

categorizing the web site as a possibly fraudulent web site, based at least in part on the at least one score.

2. The method of claim 1, wherein upon categorizing the web site as a possibly fraudulent web site, the method further comprising identifying additional terms in the text of the body field as new blacklisted terms, and adding at least one of the new blacklisted terms as a pre-defined blacklisted term.

3. The method of claim 1, wherein the set of data further comprises at least one of a zone file, an Internet chat session and a newsgroup.

4. The method of claim 1, wherein the set of data further comprises an email message.

5. The method of claim 4, wherein the plurality of components further comprises:

a header portion of the email message;

a body portion of the email message; and

a uniform resource locator (“

URL”

) incorporated within the body portion of the email message, the URL referring to the web site.

6. The method of claim 1, wherein the set of data further comprises a set of data about a server hosting the web site.

7. The method of claim 6, wherein collecting the set of data about the server hosting the web site comprises interrogating the web site.

8. A computer system, comprising a hardware processor and a set of instructions executable by the hardware processor, the set of instructions comprising:

instructions for periodically collecting, from a plurality of different sources, a set of data related to a web site, wherein the set of data comprises a web page on the web site;

instructions for dividing the set of data into a plurality of components, the plurality of components comprising an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for analyzing at least two of the plurality of components, comprising;

instructions for analyzing the text of the body field to identify at least one of a pre-defined blacklisted term and a brand name;

instructions for identifying a domain of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain;

instructions for assigning at least one score to one or more of the analyzed components; and

instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on the at least one score.

9. The computer system of claim 8, wherein the instructions for analyzing at least two of the plurality of components are configured to analyze at least one of a zone file, an Internet chat session and a newsgroup.

10. The computer system of claim 8, wherein the instructions for analyzing at least two of the plurality of components are configured to analyze an email message.

11. The computer system of claim 10, wherein the plurality of components further comprises:

a header portion of the email message;

a body portion of the email message; and

a uniform resource locator (“

URL”

) incorporated within the body portion of the email message, the URL referring to the web site.

12. The computer system of claim 8, wherein the instructions for analyzing at least two of the plurality of components are configured to analyze set of data about a server hosting the web site.

13. The computer system of claim 12, wherein collecting the set of data about the server hosting the web site comprises interrogating the web site.

14. The computer system of claim 8, further comprising instructions for, upon categorizing the web site as a possibly fraudulent web site, identifying additional terms in the text of the body field as new blacklisted terms, and adding at least one of the new blacklisted terms as a pre-defined blacklisted term.

15. A software program embodied on a non-transitory computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for periodically collecting, from a plurality of different sources, a set of data related to a web site, wherein the set of data comprises a web page on the web site;

instructions for dividing the set of data into a plurality of components, wherein the plurality of components comprises an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for analyzing at least two of the plurality of components, comprising;

instructions for analyzing the text of the body field to identify at least one of a pre-defined blacklisted term and a brand name;

instructions for identifying a domain of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain;

instructions for assigning at least one score to at least some of the analyzed components; and

instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on the at least one score.

16. The software program of claim 15, wherein the instructions for analyzing at least two of the plurality of components are configured to analyze an email message.

17. The software program of claim 16, wherein the plurality of components further comprises:

a header portion of the email message;

a body portion of the email message; and

a uniform resource locator (“

URL”

) incorporated within the body portion of the email message, the URL referring to the web site.

18. The software program of claim 15, further comprising instructions for, upon categorizing the web site as a possibly fraudulent web site, identifying additional terms in the text of the body field as new blacklisted terms, and adding at least one of the new blacklisted terms as a pre-defined blacklisted term.

19. The software program of claim 15, wherein the instructions for analyzing at least two of the plurality of components are configured to analyze at least one of a zone file, an Internet chat session and a newsgroup.