Domain Name Clustering for Early Malicious Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect malicious domain names solely based on their registered names, as they lack underlying patterns, allowing attackers to operate undetected for a significant period before their malicious intent is recognized.
Innovation Solution
A computer-implemented method using natural language processing to generate vector representations of domain names, clustering them, and analyzing clusters to identify similarities with known malicious or benign domains, employing techniques like locality sensitive hashing for efficient detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection methods are used to detect malicious domain names, then detection capability is maintained, but detection time is delayed until sufficient communications occur
Solution Approach 1:
The system performs preliminary analysis of domain name structures, patterns, and characteristics before actual malicious communications occur. By pre-establishing detection models and analyzing domain registration patterns in advance, the system can identify malicious domains at registration time rather than waiting for sufficient communication data to accumulate.
Solution Approach 2:
The patent introduces an intermediary analysis layer that examines domain names through multiple dimensions (structural patterns, registration metadata, contextual relationships) before final detection. This intermediary processing enables detection without requiring direct observation of malicious communications, bridging the gap between registration and active threat detection.
2Measurement precision
If domain names are allowed to operate for sufficient time to enable detection, then detection accuracy is improved, but the window of opportunity for attackers increases
Solution Approach 1:
The system performs preliminary detection actions at the moment of domain registration by analyzing the domain name structure, registration metadata, and pattern matching against known malicious characteristics. This preliminary detection occurs before the domain can be actively used for malicious purposes, eliminating the window of opportunity while maintaining detection accuracy through comprehensive initial analysis.
Solution Approach 2:
The detection system operates continuously from registration through operational phases, maintaining detection capability throughout the domain's lifecycle. Rather than waiting for a specific threshold of communications to achieve detection accuracy, the system continuously monitors and analyzes domain characteristics, ensuring immediate detection at registration while maintaining accuracy through ongoing observation.
3Productivity
If classification is based solely on registered domain names, then detection speed is improved, but detection reliability decreases due to lack of underlying patterns
Solution Approach 1:
The patent segments the domain name analysis into multiple independent dimensions: structural pattern analysis, registration metadata examination, contextual relationship assessment, and pattern matching against known malicious characteristics. By segmenting the detection task across these dimensions, the system achieves both speed (through parallel processing) and reliability (through multi-factor validation), overcoming the limitation of analyzing domain names in isolation.
Solution Approach 2:
The detection system creates a composite assessment by combining multiple signal types (domain structure, registration patterns, contextual data, pattern matches) into a unified detection judgment. This composite approach leverages the strengths of each individual analysis component while compensating for their individual weaknesses, achieving both rapid processing and high reliability through synthesized evaluation of multiple factors.
Data Source
AI summary
A computer-implemented method, computer system and computer program are provided for detecting malicious domain names from a set of candidate domain names based on a set of reference domain names. The method uses natural language processing to generate vector representations of the domain names, each vector representation representing a respective domain name in the set of candidate domain names and the set of reference domain names. The method clusters the vector representations to generate clusters of domain names, the domain names within each cluster being similar to each other. The method analyses the clusters of domain names to identify at least one cluster comprising at least one domain name belonging to the set of candidate domain names and at least one main name belonging to the set of reference domain names. The method provides an indication of one or more of the domain names in the set of candidate domain names included in the identified clusters as being malicious domain names.