Methods and systems for analyzing data related to possible online fraud

• US 9,026,507 B2
• Filed: 11/03/2008
• Issued: 05/05/2015
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: Thomson Reuters Global Resources
• Inventors: Shraim, Ihab, Shull, Mark
• Primary Examiner(s): WILSON, KIMBERLY LOVEL
• Application Number:
  US12/263,791
• Publication Number:
  US 20090064330A1
• Time in Patent Office: 2,374 Days
• Field of Search: None
• US Class Current: 707/694
• CPC Class Codes: H04L 12/1813 for computer conferences, e.g. chat rooms instant messaging H04L51/04; protocols for multimedia communication H04L65/1101; arrangements for multi-party communication H04L65/403; telephonic conference arrangements H04M3/56; television conference systems H04N7/15
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Various embodiments of the invention provide methods, systems and software for analyzing data. In particular embodiments, for example, a set of data about a web site may be analyzed to determine whether the web site is likely to be illegitimate (e.g., to be involved in a fraudulent scheme, such as a phishing scheme, the sale of gray market goods, etc.). In an exemplary embodiment, a set of data may be divided into a plurality of components (each of which, in some cases, may be considered a separate data set). Merely by way of example, a set of data may comprise data gathered from a plurality of data sources, and/or each component may comprise data gathered from one of the plurality of data sources. As another example, a set of data may comprise a document with a plurality of sections, and each component may comprise one of the plurality of sections. Those skilled in the art will appreciate that the analysis of a particular component may comprise certain tests and/or evaluations, and that the analysis of another component may comprise different tests and/or evaluations. In other cases, the analysis of each component may comprise similar tests and/or evaluations. The variety of tests and/or evaluations generally will be implementation specific.

Claims

1. A method, comprising:

periodically collecting, with a computer from a plurality of different sources, a set of data related to a web site, wherein the set of data comprises a web page on the web site;

accessing, with the computer, the set of data related to the web site;

dividing, with the computer, the set of data into a plurality of components, wherein the plurality of components comprises an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

analyzing at least two of the components, wherein analyzing the at least two of the plurality of components comprises;

analyzing the text of the body field to identify suspect text;

updating, with the computer, a database comprising suspect text to include at least a portion of the suspect text of the body field;

identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

comparing the IP address of the web site with the IP block assigned to the domain;

assigning at least one score to one or more of the analyzed components; and

categorizing the web site as a possibly fraudulent web site, based at least in part on the at least one score.

2. A method as recited in claim 1, wherein the set of data further comprises a newsgroup posting.

3. A method as recited in claim 1, wherein the set of data further comprises a transcript from an Internet chat session.

4. A method as recited in claim 1, wherein the set of data further comprises an email message.

5. A method as recited in claim 4, wherein the plurality of components further comprises:

a header portion of the email message;

a body portion of the email message; and

a uniform resource locator (“

URL”

) incorporated within the body portion of the email message, the URL referring to a web site.

6. A method as recited in claim 4, wherein accessing the set of data comprises receiving the email message.

7. A method as recited in claim 1, wherein the set of data further comprises a set of data about a server hosting the web site.

8. A method as recited in claim 7, wherein accessing the set of data about the server hosting the web site comprises interrogating the web site.

9. The method of claim 1, further comprising:

performing a plurality of tests on the web site, and

assigning the at least one score to the one or more of the analyzed components based on the plurality of tests.

10. A method, comprising:

periodically collecting, with a computer from a plurality of different sources, a set of data related to a web site, wherein the set of data comprises a web page on the web site; and

performing, with the computer, a plurality of tests on the web site, wherein the plurality of tests comprises;

accessing the set of data, the set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

identifying an Internet Protocol (“

IP”

) block assigned to the domain;

comparing the IP address of the web site with the IP block assigned to the domain;

identifying suspect text within the body field;

updating a database comprising suspect text to include at least a portion of the suspect text of the body field;

assigning a score based on each of the plurality of tests;

assigning a composite score to the web site based on the scores for each of the plurality of tests; and

categorizing the web site based at least in part on the composite score.

11. A method as recited in claim 10, wherein at least one of the plurality of tests relates to a content of the web site.

12. A method as recited in claim 10, wherein performing a plurality of tests comprises:

analyzing a set of WHOIS information for a domain associated with the web site.

13. A method as recited in claim 10, wherein performing a plurality of tests comprises:

searching a source of anti-abuse information for information about the web site.

14. A method as recited in claim 10, wherein performing a plurality of tests comprises:

determining the geographical location of a server hosting the web site.

15. A method as recited in claim 10, wherein performing a plurality of tests comprises:

assessing whether a server hosting the web site implements secured protocols.

16. A method as recited in claim 10, wherein performing a plurality of tests comprises:

verifying a set of active ports on a server hosting the web site.

17. A method as recited in claim 10, wherein performing a plurality of tests comprises:

downloading a web page from the web site.

18. A method as recited in claim 17, wherein performing a plurality of tests comprises:

analyzing the web page to determine whether the web page implements an online form.

19. A method as recited in claim 18, wherein performing a plurality of tests comprises:

analyzing the online form to determine whether the online form requests personal information from a user.

20. A method as recited in claim 17, wherein performing a plurality of tests comprises:

analyzing the web page for errors in spelling or grammar.

21. A method as cited in claim 17, wherein performing a plurality of tests comprises:

identifying a uniform resource locator (“

URL”

) on the web page; and

analyzing the identified URL to determine whether the identified URL references resources external to the web site.

22. A method as recited in claim 21, wherein the resources external to the web site comprise a resource selected from a group consisting of an image hosted by a legitimate web site and a web page hosted by a legitimate web site.

23. A method as recited in claim 17, wherein performing a plurality of tests comprises:

generating a representation of the web page.

24. A method as recited in claim 23, wherein performing a plurality of tests comprises:

comparing the representation of the web page with a stored representation of a web page.

25. A method as recited in claim 23, wherein the representation of the web site comprises a hash value calculated from the web page.

26. A method as recited in claim 23, wherein the representation of the web site comprises a checksum calculated from the web page.

27. The method of claim 10, wherein categorizing the web site based at least in part on the composite score comprises categorizing the web site as a possibly fraudulent web site.

28. A computer system, comprising a hardware processor and a set of instructions executable by the hardware processor, the set of instructions comprising:

instructions for periodically collecting from a plurality of different sources a set of data related to a web site, wherein the set of data comprises a web page on the web site;

instructions for accessing the set of data related to the web site;

instructions for dividing the set of data into a plurality of components, the plurality of components comprises an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for analyzing at least two of the plurality of components, comprising;

instructions for analyzing the text of the body field to identify suspect text;

instructions for updating a database comprising suspect text to include at least a portion of the suspect text of the body field;

instructions for identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain; and

instructions for assigning at least one score to one or more of the analyzed components;

and instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on the at least one score.

29. A computer system, comprising a hardware processor and a set of instructions executable by the hardware processor, the set of instructions comprising:

instructions for periodically collecting from a plurality of different sources a set of data related to a web site, wherein the set of data comprises a web page on the web site; and

instructions for performing a plurality of tests on the web site, wherein the instructions for performing the plurality of tests comprises;

instructions for accessing the set of data, the set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain;

instructions for identifying suspect text within the body field;

instructions for updating a database comprising suspect text to include at least a portion of the suspect text of the body field;

instructions for assigning a score based on each of the plurality of tests;

instructions for assigning a composite score to the web site based on the scores for each of the plurality of tests; and

instructions for categorizing the web site based at least in part on the composite score.

30. A software program embodied on a non-transitory computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for periodically collecting from a plurality of different sources a set of data related to a web site, wherein the set of data comprises a web page on the web site;

instructions for accessing the set of data related to the web site;

instructions for dividing the set of data into a plurality of components, wherein the plurality of components comprises an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for analyzing the text of the body field to identify suspect text;

instructions for updating a database comprising suspect text to include at least a portion of the suspect text of the body field;

instructions for identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain;

instructions for assigning scores to at least some of the analyzed components; and

instructions for categorizing the web site as a possibly fraudulent web site, based at least in part on one or more of the scores.

31. A software program embodied on a non-transitory computer readable medium, the software program comprising a set of instructions executable by one or more computers, the set of instructions comprising:

instructions for periodically collecting from a plurality of different sources a set of data related to a web site, wherein the set of data comprises a web page on the web site;

instructions for performing a plurality of tests on the web site, wherein the instructions for performing the plurality of tests comprises;

instructions for accessing the set of data, the set of data comprising data about a domain associated with the web site, including an Internet Protocol (“

IP”

) address associated with the web site and a body field comprising text;

instructions for identifying a domain identified by a uniform resource locator (“

URL”

) of the web site;

instructions for identifying an Internet Protocol (“

IP”

) block assigned to the domain; and

instructions for comparing the IP address of the web site with the IP block assigned to the domain;

instructions for identifying suspect text within the body field;

instructions for updating a database comprising suspect text to include at least a portion of the suspect text of the body field;

instructions for assigning a score based on each of the plurality of tests;

instructions for assigning a composite score to the web site based on the scores for each of the plurality of tests; and

instructions for categorizing the web site based at least in part on the composite score.