DomainTools Launches Innovative Predictive Domain Risk Scoring Model

SEATTLE, Feb. 21, 2018 /PRNewswire/ -- DomainTools®, the leader in domain name and DNS-based cyber threat intelligence, today announced its Domain Risk Score, a new method of predicting the level of danger or risk associated with internet domains. Providing unparalleled accuracy and breadth over newly registered domains, this model is the first to enable proactive evaluation and risk scoring of a domain based purely on the domain's intrinsic characteristics. Leveraging machine learning and predictive insights, DomainTools' Risk Score identifies factors inherent in high-risk domains from their inception, even if they have not been previously observed in malicious activity. It also predicts which type of threat the domain is most likely to represent, whether phishing, malware, or spam.

While the case for identifying and blocking dangerous domains is universally understood, a recent report from Enterprise Management Associates revealed that 79 percent of security teams are overwhelmed by the volume of alerts triggered on their network. This illustrates the need for accurate, automated identification of dangerous infrastructure. Risk Score was developed to increase efficiency among these resource-strapped security teams, many of which are looking for ways to reduce the number of false-positive notifications they receive. Machine learning and predictive analysis can intelligently automate and streamline certain security functions, and are inherently optimal for enabling risk scoring.

DomainTools has scored all of the more than 310 million currently-registered domains and continues to score tens of thousands of newly registered domains every day. Using the most complete current and historical records in the industry, DomainTools data scientists developed machine learning classifiers to identify domains that have a likelihood of being used for phishing, malware, or spam. The "F Score" data (a means of evaluating detection and false positive rates) for multiple test runs confirm that the classifiers render the correct verdicts over 99 percent of the time. Risk Score can be leveraged to:

• Surface domains that pose a significant risk to a specific organization or environment;
• Compare high-risk domains to others in the DomainTools database to identify related sites that may also pose a risk;
• Search for domains with high-risk scores in archived logs to determine if an attacker has gained entry into the network;
• Establish DomainTools monitors for alerts on future domains that are registered to the same threat actor or campaign as other known blacklisted sites.

"Our goal is to help security professionals detect, investigate, and prevent malicious activity online. Domain Risk Score further enables us to deliver on that commitment," said Tim Chen, CEO, DomainTools. "Applying the expertise of our data science team to DomainTools' detailed data sets on nearly every active domain on the internet has delivered a unique predictive model that truly helps security teams stay ahead of emerging threat infrastructure."

Domain Risk Score can be utilized by a variety of security professionals, from network defenders who block the domains that are part of phishing, malware, or spam campaigns, to incident responders and threat hunters who determine the level and type of risk associated with various domains. With Risk Score, these teams can streamline their processes from the outset, starting with a point of relevance based on domains observed touching their network. This reduces false positives and allows security teams to focus their efforts.

Domain Risk Score is available as an optional add-on to DomainTools Iris, an enterprise-grade threat investigation platform, and the scores are also available as API queries. Learn more about Iris and how DomainTools is turning threat data into threat intelligence, or to request a demo of Domain Risk Score.

About DomainTools
DomainTools helps security analysts turn threat data into threat intelligence. We take indicators from your network, including domains and IPs, and connect them with nearly every active domain on the Internet. Those connections inform risk assessments, help profile attackers, guide online fraud investigations, and map cyber activity to attacker infrastructure. Fortune 1000 companies, global government agencies, and leading security solution vendors use the DomainTools platform as a critical ingredient in their threat investigation and mitigation work. Learn more about how to connect the dots on malicious activity at http://www.domaintools.com or follow us on Twitter: @domaintools.

SOURCE DomainTools