Domain Classification Using Syntactical Features and Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional domain classification techniques face challenges in accurately distinguishing between algorithmically-generated domains (DGAs) and benign domains, often resulting in high false positives due to their reliance on purely statistical approaches, making it difficult to identify and prevent communication with malware-infected computers.
Innovation Solution
A two-step domain classification system that employs rule-based syntactical classifiers combined with machine learning, utilizing a 4-tuple syntax feature (top level domain, first private domain length, prefix length, and levels below the top level domain) to sort domains into leaves and lobes, and applies regular expressions to create classifiers that reduce misclassifications and improve efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If purely statistical approaches are used for domain classification, then the classification process is simple to implement, but the accuracy is low resulting in high false positives
Solution Approach 1:
The patent combines multiple classification approaches (statistical methods, machine learning, and rule-based syntactical classifiers) into a composite classification system. This composite approach integrates the simplicity of statistical methods with the accuracy of machine learning and the precision of syntactical rules, resolving the contradiction between ease of implementation and classification accuracy.
Solution Approach 2:
The patent segments the domain classification process into multiple independent components: statistical classification, machine learning classification, and syntactical rule-based classification. Each component operates independently and contributes to the final classification decision, allowing the system to maintain simplicity while improving accuracy through the combination of specialized classifiers.
2Device complexity
If traditional domain classification techniques are used, then the system complexity is low, but the ability to distinguish DGAs from benign domains is insufficient
Solution Approach 1:
The patent creates a composite classification system that integrates traditional statistical methods with advanced machine learning algorithms and syntactical rule-based classifiers. This composite structure maintains the low complexity advantage of traditional methods while incorporating the high distinguishing capability of modern techniques, effectively resolving the contradiction between system complexity and distinguishing capability.
Solution Approach 2:
The patent introduces syntactical rule-based classifiers as intermediary components that bridge traditional statistical classification and machine learning approaches. These rule-based classifiers provide explicit distinguishing criteria for DGA detection, enhancing the overall distinguishing capability while maintaining system structure similar to traditional approaches.
3Measurement precision
If a hierarchical classification system with multiple steps is implemented, then the classification accuracy improves, but the processing time increases
Solution Approach 1:
The patent segments the hierarchical classification process into distinct, independently executable stages: statistical classification, machine learning classification, and syntactical rule-based classification. This segmentation allows the system to process domains through multiple classification layers while maintaining efficient processing at each stage, reducing the overall time penalty of hierarchical classification.
Solution Approach 2:
The patent applies partial action by implementing the hierarchical classification system such that not all classification stages must be executed for every domain. The system can stop at earlier stages when confidence is high, applying only the necessary level of classification depth for each specific case, thereby reducing average processing time while maintaining high accuracy.
Data Source
AI summary
In one example in accordance with the present disclosure, a method for domain classification includes sorting a set of sample domains into leaves based on syntactical features of the domains. Each sample domain belongs to a family of domains. The method also includes identifying, for each leaf, a regular expression for each family with at least one domain in the leaf. The method also includes determining, for each leaf, at least one lobe with a set of domains in the leaf that matches the regular expression for a first family with at least one domain in the leaf, and that does not match the regular expression for the other families with at least one domain in the leaf. The method also includes creating a classifier for the domains in each lobe by using the set of domains from each family in the lobe as training classes for machine learning.