Abstract: Proactively detecting malicious domains using graph representation learning may be provided by extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains; expanding the seed domains to a via a passive domain name service (PDNS) crawl to include additional domains with the seed domains; collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious; constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains are represented as a node in the GNN that includes feature values associated that domain; training the GNN to classify unseen domains not associated with a node as either benign or malicious; and classifying, via the GNN, a queried domain as either benign or malicious.

Abstract: Proactively detecting malicious domains using graph representation learning may be provided by extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains; expanding the seed domains to a via a passive domain name service (PDNS) crawl to include additional domains with the seed domains; collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious; constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains are represented as a node in the GNN that includes feature values associated that domain; training the GNN to classify unseen domains not associated with a node as either benign or malicious; and classifying, via the GNN, a queried domain as either benign or malicious.

Abstract: The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.

Abstract: The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.

Abstract: The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.

Abstract: The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.

Abstract: Methods and systems for detecting malicious domains. The method comprises storing domain data for a plurality of domains and selecting a relationship parameter which represents a relationship between at least two of the domains. The method further comprises generating a graph for the domains by identifying a plurality of domain nodes, connecting the domain nodes with a plurality of edges and calculating an edge weight for each edge. The method further comprises identifying at least one domain node as a known malicious domain node and the other domain nodes as candidate domain nodes, calculating a malicious score for each candidate domain node based on the edge weights and identifying a domain in the plurality of domains as malicious if the malicious score is within a predetermined range.

Abstract: Methods and systems for detecting malicious domains. The method comprises storing domain data for a plurality of domains and selecting a relationship parameter which represents a relationship between at least two of the domains. The method further comprises generating a graph for the domains by identifying a plurality of domain nodes, connecting the domain nodes with a plurality of edges and calculating an edge weight for each edge. The method further comprises identifying at least one domain node as a known malicious domain node and the other domain nodes as candidate domain nodes, calculating a malicious score for each candidate domain node based on the edge weights and identifying a domain in the plurality of domains as malicious if the malicious score is within a predetermined range.