Roadmap for SIDN BrandGuard

Are you an SIDN BrandGuard user? We'd love to get your input!

We're constantly adding new tools and features to SIDN BrandGuard. As scammers keep coming up with new ploys, we have to keep adapting to counter them. Last month, Product Owner Martijn Sanders presented his future vision and a feature roadmap for SIDN BrandGuard at a meetup. Martijn spoke to the audience of BrandGuard subscribers about the functional improvements planned for the short term and the innovations that may be coming in the years ahead.

Roadmap SIDN BrandGuard

Figure 1: SIDN BrandGuard Roadmap

In the roadmap above, the items in the darker boxes are assured of a place in the development schedule. We'll be discussing the items in the lighter boxes with users in the period ahead to establish what they would most like to see added, and we'll define development priorities accordingly.

We'd love to hear from interface users

Each of the items that we're thinking of including on the BrandGuard roadmap is briefly outlined below. We'd love to know what you see as the 5 priorities, and which is top of your wish list. Use our special web form to make your selection, and tell us about anything we might have missed off the list.

Risk assessment

Analysis of a site to assess the risk that it's a phishing site or has other malicious content. Intended to help you prioritise.

Track this site

Functionality that allows you to actively track a flagged website. Any change in the site's DNS configuration or content generates an alert.

Website information and screenshots

Additional information about a flagged website, the infrastructure and possibly the CMS used. A screenshot of the site would also be shown on the dashboard, removing the need to expose yourself to potentially malicious content by visiting.

Guided workflows

The implementation of workflows in which users are given additional support with the detection/reporting and response/follow-up processes.

Statistics and reports

Accessible reports detailing how many domains have been detected, how many problems have been resolved, the types of site involved, etc.

Avoidance detection

There are ways of avoiding detection by automated scanners (outside .nl). We could develop methods to identify sites that employ avoidance techniques, and flag them up as elevated risks.

.nl-to-ccTLD/gTLD mapping

Not all zones publish all the domain names within them. Therefore, when a suspicious .nl domain is detected, we could check whether corresponding domain names exist in any other zones, thus increasing the detection rate.

Mobile scanning

SMS phishing scams sometimes involve websites that have both a mobile version (with malicious content) and a desktop version (without). We could extend our scans to check both instances of any site that has distinct mobile and desktop versions.

DNS risk analysis

Potentially malicious registrations can be identified by analysing DNS traffic profiles and registration patterns. The resulting risk profiles could be shown on the dashboard, enabling you to decide your follow-up priorities.

Subdomain detection

At the moment, SIDN BrandGuard scans only domain names (e.g. businessname.nl). However, we could extend our scanning to include subdomains (e.g. selfcareportal.businessname.nl). That would significantly increase the amount of data presented on the dashboard, necessitating modification of the dashboard to keep it surveyable.

AI detection of logo-text combinations

Our logo detection technology is very good with logos. However, logos are often used in combination with text. For example, the national government's logo will often appear together with the name of a ministry. It could be useful, therefore, to adapt our system to take account of any text that appears in combination with a logo.

Manual URL insertion

Some scams make use of domains that we can't scan optimally, e.g. because no zone file is published, as with the Chinese and South African domains. We do find suspect sites within such domains, but we can't be sure of finding them all. To help address that problem, we could make it possible for a domain to be entered into SIDN BrandGuard manually for subsequent monitoring. That would further increase the detection rate.

AI-enabled profiler

Our existing profiler looks at a number of features to categorise scanned sites as e-commerce sites, portals, parking pages, phishing sites, etc. If we developed an AI model to perform the checks, that would increase both the speed and the reliability of the profiling process.

> Tell us your top 5 features