Cloud

2/22/2018
05:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

DomainTools Launches Predictive Domain Risk Scoring Model

Domain Risk Score is intended to identify dangerous domains and enables proactive network defense

SEATTLE, Feb. 21, 2018 -- DomainTools®, the leader in domain name and DNS-based cyber threat intelligence, today announced its Domain Risk Score, a new method of predicting the level of danger or risk associated with internet domains. Providing unparalleled accuracy and breadth over newly registered domains, this model is the first to enable proactive evaluation and risk scoring of a domain based purely on the domain's intrinsic characteristics. Leveraging machine learning and predictive insights, DomainTools' Risk Score identifies factors inherent in high-risk domains from their inception, even if they have not been previously observed in malicious activity. It also predicts which type of threat the domain is most likely to represent, whether phishing, malware, or spam.

While the case for identifying and blocking dangerous domains is universally understood, a recent report from Enterprise Management Associates revealed that 79 percent of security teams are overwhelmed by the volume of alerts triggered on their network. This illustrates the need for accurate, automated identification of dangerous infrastructure. Risk Score was developed to increase efficiency among these resource-strapped security teams, many of which are looking for ways to reduce the number of false-positive notifications they receive. Machine learning and predictive analysis can intelligently automate and streamline certain security functions, and are inherently optimal for enabling risk scoring.

DomainTools has scored all of the more than 310 million currently-registered domains and continues to score tens of thousands of newly registered domains every day. Using the most complete current and historical records in the industry, DomainTools data scientists developed machine learning classifiers to identify domains that have a likelihood of being used for phishing, malware, or spam. The "F Score" data (a means of evaluating detection and false positive rates) for multiple test runs confirm that the classifiers render the correct verdicts over 99 percent of the time. Risk Score can be leveraged to:

  • Surface domains that pose a significant risk to a specific organization or environment;
  • Compare high-risk domains to others in the DomainTools database to identify related sites that may also pose a risk;
  • Search for domains with high-risk scores in archived logs to determine if an attacker has gained entry into the network;
  • Establish DomainTools monitors for alerts on future domains that are registered to the same threat actor or campaign as other known blacklisted sites.

"Our goal is to help security professionals detect, investigate, and prevent malicious activity online. Domain Risk Score further enables us to deliver on that commitment," said Tim Chen, CEO, DomainTools. "Applying the expertise of our data science team to DomainTools' detailed data sets on nearly every active domain on the internet has delivered a unique predictive model that truly helps security teams stay ahead of emerging threat infrastructure."

Domain Risk Score can be utilized by a variety of security professionals, from network defenders who block the domains that are part of phishing, malware, or spam campaigns, to incident responders and threat hunters who determine the level and type of risk associated with various domains. With Risk Score, these teams can streamline their processes from the outset, starting with a point of relevance based on domains observed touching their network. This reduces false positives and allows security teams to focus their efforts.

Domain Risk Score is available as an optional add-on to DomainTools Iris, an enterprise-grade threat investigation platform, and the scores are also available as API queries. Learn more about Iris and how DomainTools is turning threat data into threat intelligence, or to request a demo of Domain Risk Score.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.