Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/22/2018
05:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

DomainTools Launches Predictive Domain Risk Scoring Model

Domain Risk Score is intended to identify dangerous domains and enables proactive network defense

SEATTLE, Feb. 21, 2018 -- DomainTools®, the leader in domain name and DNS-based cyber threat intelligence, today announced its Domain Risk Score, a new method of predicting the level of danger or risk associated with internet domains. Providing unparalleled accuracy and breadth over newly registered domains, this model is the first to enable proactive evaluation and risk scoring of a domain based purely on the domain's intrinsic characteristics. Leveraging machine learning and predictive insights, DomainTools' Risk Score identifies factors inherent in high-risk domains from their inception, even if they have not been previously observed in malicious activity. It also predicts which type of threat the domain is most likely to represent, whether phishing, malware, or spam.

While the case for identifying and blocking dangerous domains is universally understood, a recent report from Enterprise Management Associates revealed that 79 percent of security teams are overwhelmed by the volume of alerts triggered on their network. This illustrates the need for accurate, automated identification of dangerous infrastructure. Risk Score was developed to increase efficiency among these resource-strapped security teams, many of which are looking for ways to reduce the number of false-positive notifications they receive. Machine learning and predictive analysis can intelligently automate and streamline certain security functions, and are inherently optimal for enabling risk scoring.

DomainTools has scored all of the more than 310 million currently-registered domains and continues to score tens of thousands of newly registered domains every day. Using the most complete current and historical records in the industry, DomainTools data scientists developed machine learning classifiers to identify domains that have a likelihood of being used for phishing, malware, or spam. The "F Score" data (a means of evaluating detection and false positive rates) for multiple test runs confirm that the classifiers render the correct verdicts over 99 percent of the time. Risk Score can be leveraged to:

  • Surface domains that pose a significant risk to a specific organization or environment;
  • Compare high-risk domains to others in the DomainTools database to identify related sites that may also pose a risk;
  • Search for domains with high-risk scores in archived logs to determine if an attacker has gained entry into the network;
  • Establish DomainTools monitors for alerts on future domains that are registered to the same threat actor or campaign as other known blacklisted sites.

"Our goal is to help security professionals detect, investigate, and prevent malicious activity online. Domain Risk Score further enables us to deliver on that commitment," said Tim Chen, CEO, DomainTools. "Applying the expertise of our data science team to DomainTools' detailed data sets on nearly every active domain on the internet has delivered a unique predictive model that truly helps security teams stay ahead of emerging threat infrastructure."

Domain Risk Score can be utilized by a variety of security professionals, from network defenders who block the domains that are part of phishing, malware, or spam campaigns, to incident responders and threat hunters who determine the level and type of risk associated with various domains. With Risk Score, these teams can streamline their processes from the outset, starting with a point of relevance based on domains observed touching their network. This reduces false positives and allows security teams to focus their efforts.

Domain Risk Score is available as an optional add-on to DomainTools Iris, an enterprise-grade threat investigation platform, and the scores are also available as API queries. Learn more about Iris and how DomainTools is turning threat data into threat intelligence, or to request a demo of Domain Risk Score.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23281
PUBLISHED: 2021-04-13
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to ro...
CVE-2021-27598
PUBLISHED: 2021-04-13
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet.
CVE-2021-27600
PUBLISHED: 2021-04-13
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored ...
CVE-2021-27601
PUBLISHED: 2021-04-13
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attac...
CVE-2021-27602
PUBLISHED: 2021-04-13
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the sour...