Clustering Algorithm for Malicious Domain Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Identifying malicious domain names associated with campaigns is challenging due to the numerous possibilities for typos, similar wording, and other variations, making it difficult to detect all or most of the domain names involved in malicious activities.

Innovation Solution

A clustering algorithm is used to process passive DNS records, identifying and grouping domain names associated with malicious campaigns by leveraging known malicious domains, and integrating this information into a domain filter to block or notify users of potential threats in network traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional domain filtering methods are used to block known malicious domains, then known malicious domains can be blocked, but new malicious domains with typos or variations cannot be detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidcoverage of malicious domain variations

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system pre-computes and stores expected typo variations and similar domain names for legitimate campaign domains before the malicious domains are registered. This preliminary preparation enables the filtering system to proactively block malicious variations before they are used in attacks, rather than reacting after detection

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates copies of legitimate campaign domain names with intentional typographical variations and similar wording patterns. These copied variations are stored in the filtering system to match and block corresponding malicious domains, allowing detection of domains like 'compnysecuritybreach2018.com' without needing to know the specific typo in advance

Inventive Principle:

Principle #26Copying

2Measurement precision

If manual monitoring of domain registrations is performed to identify malicious domains, then some malicious domains can be detected, but the large volume of domain variations makes comprehensive detection difficult

Engineering Contradiction:

Improvedetection precisionVSAvoiddetection throughput

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system automatically generates lists of potential malicious domain variations by applying typo generation algorithms and similarity metrics to legitimate campaign domains. This self-service approach eliminates the need for manual monitoring of each domain registration, allowing the system to handle large volumes of domain variations autonomously

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces manual domain monitoring and analysis with automated computational methods including typo generation algorithms, string similarity calculations, and machine learning-based classification. This substitution enables high-throughput processing of domain registrations while maintaining precise detection capabilities

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Object-affected harmful factors

If a domain filter blocks all domains similar to legitimate campaign domains, then malicious domains are blocked, but legitimate campaign domains may also be blocked causing false positives

Engineering Contradiction:

Improveprotection against malicious domainsVSAvoiduser accessibility to legitimate sites

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system applies different filtering rules and similarity thresholds to different domains based on their specific characteristics. Instead of using a uniform blocking rule for all campaign domains, the system tailors the typo generation and matching parameters to each domain's structure, length, and pattern, allowing precise differentiation between malicious and legitimate domains

Inventive Principle:

Principle #3Local quality

4Adaptability or versatility

If extensive domain name variations are monitored to catch all malicious domains, then detection coverage improves, but the complexity of the filtering system increases

Engineering Contradiction:

Improvecoverage of domain variationsVSAvoidfiltering system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The filtering system is divided into modular components: a typo generation module that creates variations, a similarity calculation module that compares domains, and a classification module that determines maliciousness. This segmentation allows each component to handle specific tasks independently, reducing overall system complexity while maintaining comprehensive coverage

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12132752B2Identification of malicious domain campaigns using unsupervised clustering

Publication Date: 2024.10.29 PALO ALTO NETWORKS INC

AI summary

The technology presented herein enables the use of a clustering algorithm to identify additional malicious domains based on known malicious domains. A domain identifier system identifies a first plurality of domain names associated with a malicious domain campaign and seeding a first clustering algorithm with the first plurality of domain names. After seeding the first clustering algorithm, the domain identifier system uses the first clustering algorithm to process passive domain name system (DNS) records to identify and group a second plurality of domain names associated with the malicious domain campaign.