Detecting Algorithmically Generated Domains via Graph Substring Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches are ineffective in detecting algorithmically generated domains that are registered with domain name registrars, as they typically rely on NXDOMAIN responses and patterns from user queries, which are not applicable in the registered domain scenario, and there is a significant need for efficient detection methods.
Innovation Solution
A system and process that collect registered domain names, generate a graph of substrings associated with each domain, and identify clusters of algorithmically generated domains using automated analysis, leveraging machine learning and graph analysis to detect registered Domain Generation Algorithms (DGAs) with low false positive rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing detection approaches relying on NXDOMAIN responses and user query patterns are used, then detection of unregistered algorithmically generated domains is possible, but detection of registered algorithmically generated domains fails
Solution Approach 1:
Instead of detecting algorithmically generated domains through their failure to resolve (NXDOMAIN responses), the patent inverts the approach by analyzing successfully registered domains to identify algorithmic generation patterns. The system examines registered domain data for characteristics of algorithmic generation without relying on resolution failure, thereby adapting detection to work with registered domains while maintaining reliability.
Solution Approach 2:
The patent changes the detection parameters from resolution-based metrics (NXDOMAIN responses, query patterns) to registration-based metrics (domain name structure, substring patterns, entropy measures). By transforming the detection parameters to match the registered domain scenario, the system achieves both reliability in detection and versatility across different domain registration states.
2Measurement precision
If comprehensive analysis of all registered domains is performed to ensure accurate detection, then detection precision improves, but computational complexity and processing time increase
Solution Approach 1:
The patent segments the domain analysis process into distinct components: extracting substrings from domain names, analyzing substring frequencies, calculating entropy measures, and applying machine learning classifiers. This segmentation allows each component to be optimized independently, maintaining high detection precision while managing system complexity through modular architecture.
Solution Approach 2:
The patent introduces intermediate representations (substring frequencies, entropy values, graph structures) that mediate between raw domain data and final detection results. These intermediaries simplify the analysis by transforming complex domain name patterns into manageable features that can be processed by machine learning classifiers, thereby reducing overall system complexity while preserving detection precision.
3Measurement precision
If machine learning classifiers are applied to reduce false positives, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary analysis by extracting and analyzing substring patterns and calculating entropy measures before applying machine learning classifiers. This preliminary action pre-processes the data into meaningful features, reducing the computational burden on the classifiers and allowing faster processing while maintaining high accuracy and low false positive rates.
Solution Approach 2:
The patent replaces traditional rule-based detection mechanics with machine learning classifiers that automatically learn patterns from data. This substitution reduces false positives by adapting to complex patterns that rules cannot capture, while the use of pre-computed features and efficient algorithms minimizes the additional processing time required.
Data Source
AI summary
Various techniques for detecting algorithmically generated domains in registered domain data are disclosed. In some embodiments, a system/process/computer program product for detecting algorithmically generated domains in registered domain data includes collecting registered domain names; generating a graph of the registered domain names and outlier substrings associated with each of the registered domain names; and generating a set of registered DGA domain clusters based on an automated analysis of the graph.