Adaptive DGA-Generated Domain Detection with Wide-and-Deep Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for detecting malicious domain names generated by domain generation algorithms (DGAs) are inadequate due to their reliance on static matching and lists, which become outdated quickly, lack flexibility, and produce numerous false positives, making it difficult to differentiate between legitimate and malicious communications.
Innovation Solution
A deep and wide machine learning architecture is employed to detect DGA-generated domains by utilizing layers such as input, text vectorization, LSTM, and custom features like length, entropy, and n-gram similarity scores, which adapt to evolving dictionaries and patterns, reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If static matching or static lists are used to detect malicious domain names, then the detection method is simple to implement, but the solutions quickly become outdated and unreliable
Solution Approach 1:
The patent transitions from static matching lists to dynamic machine learning models that continuously adapt to new DGA patterns. The system uses trained neural networks that can evolve and update their detection capabilities, making the detection mechanism dynamic rather than static, thereby resolving the contradiction between ease of implementation and detection reliability.
Solution Approach 2:
The patent changes the fundamental parameters of detection by moving from simple string matching to complex feature analysis including character n-grams, domain structure patterns, and statistical properties. This parameter transformation enables the system to detect evolving DGA techniques while maintaining automated operation.
2Ease of operation
If conventional detection solutions are used, then the implementation is straightforward, but they lack flexibility and accuracy in detecting varying patterns
Solution Approach 1:
The system employs dynamic machine learning models that can adapt to varying DGA patterns automatically. The neural networks are trained on diverse datasets and can generalize to new patterns without manual reconfiguration, providing both ease of operation and high adaptability to different malicious domain generation techniques.
Solution Approach 2:
The patent creates a universal detection system using machine learning models that can handle multiple types of DGA patterns simultaneously. The same model architecture can detect various DGA techniques by learning common underlying patterns, making the system versatile across different threat scenarios while maintaining a single unified operation interface.
3Speed
If filters use static lists of malicious domain names, then the filtering process is fast, but they fail to detect unseen or unknown domain names
Solution Approach 1:
The system performs preliminary training of machine learning models on extensive datasets of known DGA patterns before deployment. This preliminary action enables the models to learn generalizable features and patterns that can quickly identify unseen malicious domains during actual filtering operations, maintaining both speed and accuracy.
Solution Approach 2:
The patent uses feature extraction techniques that create compressed representations (embeddings) of domain name characteristics. These copied feature vectors capture essential patterns efficiently, allowing fast comparison and classification while preserving the ability to detect novel variants through learned feature patterns rather than exact string matching.
4Reliability
If solutions detect all potential malicious domains aggressively, then detection coverage is high, but they yield numerous false positives
Solution Approach 1:
The patent applies different detection strategies and feature importance weights to different parts of the domain name structure and different types of patterns. The machine learning model learns which features are most indicative of maliciousness in specific contexts, enabling targeted detection that maintains high coverage while reducing false positives through nuanced, localized analysis rather than uniform aggressive filtering.
Data Source
AI summary
A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.