Automated Cyber-Attack Detection via Domain Link Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate in detecting and analyzing coordinated cyber-attacks, particularly in identifying links between command and control servers, domains, and malware, and in determining the source of sophisticated attacks, as they rely on manual processes and do not effectively reconstruct broader attack campaigns or visualize connections outside of identified botnets.
Innovation Solution
A method and system using a web crawler to construct a massive database of domain and subdomain IP addresses, identifying links through hyperlinks and content similarity, and sending event notifications to a central server for real-time threat analysis and IP address classification, enabling the detection of coordinated attacks by constructing topological maps of malicious connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual processes are used to establish connections between command and control servers and attacks, then resource consumption is high and time-consuming, but automation can be implemented to reduce manual effort
Solution Approach 1:
The system performs preliminary actions by proactively crawling the web to build a comprehensive database of domain-subdomain-IP relationships before attacks occur. This pre-built knowledge base enables rapid automated analysis when attacks are detected, eliminating the need for manual connection establishment while reducing system complexity during incident response
Solution Approach 2:
The patent introduces an intermediary database that stores pre-established relationships between domains, subdomains, and IP addresses. This intermediary structure acts as a mediator between attack detection and source identification, enabling automated correlation without direct manual intervention while maintaining manageable system complexity
2Measurement precision
If sophisticated masking techniques are used by attackers, then attack source identification becomes difficult, but comprehensive database construction can reveal hidden connections
Solution Approach 1:
The system transitions from analyzing single IP addresses or domains in isolation to examining multi-dimensional relationships across domains, subdomains, and IP addresses simultaneously. By constructing topological maps that visualize connections across multiple dimensions, the system can penetrate sophisticated masking techniques and identify attack sources rapidly with high precision
Solution Approach 2:
The database structure serves multiple functions: it stores domain information, subdomain relationships, IP address mappings, and connection topologies. This universal database can handle various attack types and analysis needs, enabling rapid identification of attack sources regardless of the masking techniques employed while reducing analysis time
3Adaptability or versatility
If malware is written specifically for each target, then pattern recognition between attacks is difficult, but connection analysis can reveal coordinated campaigns
Solution Approach 1:
The system extracts and analyzes the connection topology between domains, subdomains, and IP addresses separately from the malware code itself. By taking out the infrastructural relationships from the specific malware implementations, the system can identify coordinated campaigns even when each attack uses custom-written malware, preserving information about attack coordination while adapting to diverse malware variants
Data Source
AI summary
A method of detecting coordinated attacks on computer and computer networks via the internet. The method includes using a web crawler to crawl the world wide web to identify domains and subdomains and their associated IP addresses, and to identify links between domains and subdomains, and storing the results in a database. When an IP address is identified as malicious or suspicious, the IP address is used as a lookup in the database to identify the associated domain and subdomain, and linked domains and subdomains. Those linked domains and subdomains are then identified as malicious or suspicious.