Malicious domain scoping recommendation system

Abstract

Identification of malicious network domains through use of links analysis of graph representation of network activity, such as a bipartite graphs. An example method includes setting an initial reputation score for each of a plurality of host computers and each of a plurality of domains accessed by the plurality of host computers; until a predefined condition is satisfied, iteratively rescoring the reputation scores for each of the plurality of host computers based upon the reputation scores of the plurality of domains; and rescoring the reputation scores for each of the plurality of domains based upon the reputation scores of the plurality of host computers; and determining, based upon the rescored reputation scores for each of the plurality of host computers and the rescored reputation scores for each of the plurality of domains, whether one or more domains amongst the plurality of domains are exhibiting malicious behavior.