International Business Machines Corporation

Andrii Sergeevich Iesiev

Cheng-Ta Lee

Russell L Couturier

Iosif Viorel Onut

Gideon Zenz

Bo-Yu Kuo

Shawn Richard Delton

Darshan Gencarelle

Jacobus P Lodewijkx

A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.

Creating a malware domain sinkhole by domain clustering

Countering phishing attacks by generating multiple synthetic victims, where each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, where the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, providing any of the synthetic victim information of the synthetic victims to a computer-hosted phishing site, storing the synthetic victim information in a computer-accessible database, receiving from a computer-hosted target site information provided to the computer-hosted target site by a requestor, identifying in the computer-accessible database database synthetic victim information matching the requestor information, and notifying the computer-hosted target site that the requestor information is of a synthetic victim.

Countering phishing attacks

Identity data collected from network flows is managed and graphed according to a hierarchical schema that reduces data storage requirements and enhance database querying efficiencies. Preferably, the schema comprises a set of objects, such as a 'source' object, a 'time' object, and an &#x201c;identity&#x201d; object. A source object represents a source of an identity, namely, where an identity comes from. A time object represents a time bucket along a particular time frame corresponding to when an identity appears on the network. An identity object represents the actual identity itself. As each distinctive identity data is detected, it is added to the graph, preferably just once, and relationships between particular pairs of identities are identified. The resulting graph has significantly-reduced storage requirements, and it facilitates the discovery of linked identities much more efficiently, even when the identities are not directly connected.

Representing identity data relationships using graphs

Growing community of inventors

Florence, MA, United States of America

Andrii Sergeevich Iesiev