Domain Drift Monitoring for Malicious Domain Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately identify and filter out malicious domains used in cyberattacks, often resulting in false positives and inadequate risk assessment due to the difficulty in tracking domain registrations over time and determining the malicious nature of newly registered domains.
Innovation Solution
A method utilizing drift monitoring and contextual data to compare baseline and dynamic domain sets, assessing IP address risk scores based on the risk levels of other domains associated with the same IP address, and implementing enriched data from sources like VirusTotal to enhance the detection of potentially malicious domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If domain monitoring is performed using permutations of known domains, then domain detection capability is improved, but false positives increase and measurement precision deteriorates
Solution Approach 1:
The system dynamically updates domain monitoring by comparing baseline domain sets against continuously updated dynamic sets that reflect current domain registrations. This dynamic comparison enables the system to adapt to evolving domain names and reduce false positives by focusing only on newly registered or changed domains rather than static permutations.
Solution Approach 2:
The system changes the monitoring parameter from static domain permutations to temporal domain registration changes. By monitoring drift in domain registration over time and comparing baseline sets with updated sets, the system identifies malicious domains based on their emergence patterns rather than fixed permutations, improving precision while maintaining detection capability.
2Speed
If real-time domain registration monitoring is implemented, then response speed to malicious domains is improved, but system complexity increases
Solution Approach 1:
The system segments domain monitoring into distinct components: a baseline set of known domains, a dynamic set of current registrations, and a comparison mechanism that identifies drift. This segmentation allows real-time monitoring to be achieved through manageable, modular operations rather than a monolithic complex system.
Solution Approach 2:
The system introduces an intermediary comparison mechanism that processes baseline and dynamic sets to identify potentially malicious domains. This intermediary layer simplifies the complexity by providing a clear, systematic approach to filtering and ranking domains based on registration patterns and risk assessment.
3Measurement precision
If IP address risk scoring based on multiple domains is implemented, then risk assessment accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary risk assessment by pre-establishing baseline domain sets and continuously updating dynamic sets before final risk determination. This preliminary organization of data into structured sets enables faster processing during actual risk assessment, as the comparison framework is already in place and只需 requires applying it to new registrations.
Solution Approach 2:
The system applies partial risk assessment by focusing computational resources on domains that show drift from baseline patterns. Rather than scoring all domains uniformly, the system identifies candidate malicious domains through baseline-dynamic comparison and then applies detailed IP address risk scoring only to these candidates, reducing overall processing time while maintaining accuracy.
Data Source
AI summary
Example embodiments of the present disclosure provide for an example method including generating a baseline set of domains by comparing domains of interest to a group of existing registered domains. The domains of interest are generated using a permutation engine based on a first domain. The example method includes periodically generating a dynamic set of domains by comparing the domains of interest to an updated group of existing registered domains. The updated group is obtained in real-time. The example method includes determining a potentially malicious domain based on comparing the baseline set and dynamic set. The example method includes for each respective potentially malicious domain: obtaining an IP address associated with the potentially malicious domain and determining an IP address risk score. The example method includes determining a potentially malicious domain is a malicious domain based on the IP address risk score of the potentially malicious domain.