Domain Classification via Ensemble ML Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for classifying web domains as malicious or benign are inefficient, leading to false positives and false negatives due to the overwhelming volume of indicators, which can result in either ignoring potentially malicious traffic or inundating organizations with unnecessary alerts, compromising cybersecurity posture.
Innovation Solution
A system that uses a combination of domain registration data, sandbox data, and web crawling data to create feature vectors, which are then processed by multiple classifiers such as decision trees, support vector machines, or neural networks to estimate the maliciousness of unknown domains, providing a confidence score for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual review methods are used to classify web domains, then classification accuracy can be maintained, but the processing speed and scalability deteriorate due to the overwhelming volume of indicators
Solution Approach 1:
The patent replaces manual mechanical review processes with automated machine learning classifiers. Multiple classifiers (decision trees, support vector machines, neural networks) are trained on historical indicator data to automatically evaluate and classify new indicators, eliminating the need for manual review while maintaining high accuracy through ensemble methods and continuous model training.
Solution Approach 2:
The patent introduces feature vectors as an intermediary representation between raw indicator data and classification decisions. Indicators are transformed into structured feature vectors containing multiple attributes (e.g., domain age, registration information, web linking characteristics), which then serve as input to the classification system, enabling automated processing while preserving discriminative information.
2Productivity
If automated matching of indicators is implemented, then processing speed improves, but classification accuracy deteriorates due to false positives and false negatives
Solution Approach 1:
The patent merges multiple classification approaches by combining multiple trained classifiers into an ensemble system. Each classifier (decision tree, support vector machine, neural network) processes indicator feature vectors and their predictions are aggregated through voting or weighted combination, producing more reliable and accurate classification decisions than any single classifier alone.
Solution Approach 2:
The patent changes parameters by training classifiers on diverse sets of features and adjusting classification thresholds dynamically. The system evaluates multiple feature combinations and optimizes decision boundaries to minimize false positives and false negatives, adapting parameter settings based on performance feedback and data characteristics.
3Measurement precision
If multiple classifiers are used to improve accuracy, then classification precision improves, but system complexity increases
Solution Approach 1:
The patent segments the classification task into multiple independent classifier components, each specialized for different types of pattern recognition. Decision trees handle rule-based decisions, support vector machines manage boundary classification, and neural networks capture complex non-linear relationships. This segmentation allows each component to be optimized independently while working together as an ensemble.
Solution Approach 2:
The patent creates a universal classification framework that can accommodate multiple different classifier types through a common interface and feature vector representation. The system is designed to be multi-functional, supporting various classification algorithms and enabling flexible configuration of classifier combinations based on specific security requirements and performance needs.
Data Source
AI summary
A method evaluates whether a web domain is malicious. The method forms a feature vector, including data from web crawling. The features may include: whether the domain is cached from web crawling; the number of unique publicly accessible URIs hosted on the domain; the number of backlinks referencing the domain; the number of unique domain names in referring backlinks; the number of unique IP addresses in the referring backlinks; the number of unique IP address groups in the referring backlinks; and the proportion of hyperlinks to the domain from popular websites. For multiple classifiers, the method computes a probability that the domain is malicious. Each classifier is a decision tree constructed according to a subset of features and a subset of sample feature vectors. The method combines the individual probabilities to form an overall probability and returns the computed overall probability to the client.