Domain Malware Family Classification via Rank Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for accurately classifying DNS domain names to malware families, which hinders effective cybersecurity measures and threat mitigation.
Innovation Solution
A computer-implemented method that identifies malicious domains, calculates rank coefficients, and applies tags to classify domains based on correlation with a seed domain, utilizing feature vectors and threat intelligence to determine malware family affiliation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current classification methods are used, then domain classification can be performed, but the accuracy of classifying domains to malware families is insufficient
Solution Approach 1:
The patent segments the classification process into multiple distinct stages: extracting temporal features from domain registration data, calculating rank correlation coefficients between domains, comparing extracted features against threshold values, and assigning malware family tags. This segmented approach allows each stage to be optimized independently, improving overall classification accuracy while maintaining reliable threat mitigation.
Solution Approach 2:
The patent performs preliminary actions by pre-processing domain data to extract temporal features before classification. It pre-calculates rank correlation coefficients and prepares threshold comparisons in advance, enabling more accurate and reliable classification when actual threat assessment is needed.
2Loss of information
If more comprehensive analysis methods are applied, then threat understanding improves, but computational complexity increases
Solution Approach 1:
The patent extracts only the most relevant temporal features from domain data, such as registration time, expiration time, and age. By taking out only these critical features rather than analyzing all possible domain attributes, the system maintains high threat intelligence quality while reducing computational complexity.
Solution Approach 2:
The patent transforms domain temporal data into rank correlation coefficients and compares them against threshold values. This parameter transformation simplifies the analysis by converting complex temporal relationships into comparable numerical values, reducing computational complexity while preserving essential threat intelligence.
Data Source
AI summary
A method for classifying domains to malware families includes identifying a corpus of malicious domains, identifying one or more suspicious domains, extracting a timeframe corresponding to the one or more suspicious domains, calculating a rank coefficient between the one or more suspicious domains and a current seed domain of the corpus of malicious domains, determining whether the rank correlation coefficient exceeds a rank threshold for the one or more suspicious domains, comparing a number of suspicious domains whose correlation coefficients exceed the rank threshold to a relation threshold, and responsive to determining the number of suspicious domains whose correlation coefficients exceed the rank threshold exceeds the relation threshold, applying a tag to the suspicious domains indicating that the one or more suspicious domains correspond to a same malware family as the current seed domain.