Combo-squatting Domain Linkage via Nameserver Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer networking systems are ineffective in detecting malicious domains, known as ComboSquatting domains, which can impersonate legitimate companies or services by incorporating trademarked names, making it difficult to identify and mitigate potential malicious activities such as phishing or malware.
Innovation Solution
A method and system that groups domain names by nameservers, splits words in each domain name, generates a wordlist, finds feature words, and extracts malicious domain names and corresponding registrant data, using techniques like inverse document frequency to identify potentially malicious domains registered by the same entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If domain names are grouped by nameserver and analyzed using word splitting and feature extraction, then the ability to identify malicious domains is improved, but the system complexity increases
Solution Approach 1:
The patent segments domain names into individual words using word splitting, creating wordlists from domain names. This segmentation allows for easier analysis of individual components (words) rather than treating entire domain names as single units, improving detection accuracy while managing complexity through modular processing
Solution Approach 2:
The patent introduces feature words as intermediary elements that connect domain names to their malicious intent. By extracting and analyzing feature words (such as uncommon or suspicious terms) from domain names, the system creates an intermediate layer of analysis that improves detection without requiring direct complex analysis of all domain name components
2Reliability
If comprehensive domain analysis is performed to identify malicious domains, then detection capability is improved, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary word splitting and wordlist generation from domain names before the actual malicious domain detection process. By pre-processing domain names into wordlists and identifying feature words in advance, the system reduces the computational burden during the detection phase, improving reliability while minimizing analysis time
Solution Approach 2:
The patent extracts only the essential feature words from domain names rather than analyzing entire domain names in full detail. By taking out and focusing on specific suspicious or uncommon words that indicate malicious intent, the system achieves reliable detection with reduced analysis time compared to comprehensive domain name analysis
Data Source
AI summary
A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.