Domain Name Identification with Sequence Matrix Classification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for identifying malicious domain names in network communications lack accuracy and efficiency, particularly in preventing data transmission between infected terminals and malicious terminals, which poses a significant security risk.

Innovation Solution

A network device employs a domain name feature analysis model and classification model using an input and output gate with activation functions and a feedback gate to process character vectors, determining a sequence matrix and feature vector for domain names, enabling accurate classification of legal and illegal domain names without requiring a character feature library.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If character extraction and comparison with stored character feature library is used for domain name identification, then the identification process can be implemented, but the accuracy of identifying malicious domain names is insufficient

Engineering Contradiction:
Improveidentification accuracyVSAvoidsecurity risk
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent transforms the domain name identification problem from character-level comparison to sequence matrix-level analysis. By converting domain names into sequence matrices and using neural network models (LSTM, GRU, CRNN) to extract deep features, the system achieves higher identification accuracy. The parameter transformation from simple character features to complex sequence patterns enables the system to detect malicious domain names more reliably without false positives.

Inventive Principle:
Principle #35Parameter changes

2Productivity

If traditional domain name identification methods are used, then the process is simple, but the efficiency and precision of domain name classification are insufficient

Engineering Contradiction:
Improveclassification efficiencyVSAvoidclassification precision
Core Design Contradiction:
ProductivityVSMeasurement precision

Solution Approach 1:

The patent replaces traditional mechanical character comparison methods with neural network-based sequence modeling. The LSTM, GRU, and CRNN models automatically learn and extract features from domain name sequences, eliminating the need for manual feature engineering and character-by-character analysis. This substitution dramatically improves both classification efficiency and precision, as the neural networks can process domain names end-to-end and identify malicious patterns that traditional methods miss.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Ease of manufacture

If character feature library comparison is used for domain name identification, then the method can be implemented, but it requires additional resources and complexity

Engineering Contradiction:
Improveimplementation simplicityVSAvoidsystem complexity
Core Design Contradiction:
Ease of manufactureVSDevice complexity

Solution Approach 1:

The patent implements self-service through automatic feature extraction and sequence matrix generation. The system automatically converts domain names into sequence matrices and uses neural networks to extract features without requiring manual creation or maintenance of character feature libraries. The models are trained once and then autonomously classify domain names, eliminating the need for continuous updates to feature libraries and reducing system complexity despite using advanced neural network architectures.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3799398B1Domain name identification
Publication Date: 2025.09.17 NEW H3C SECURITY TECH CO LTD
  • EP3799398B1 patent drawingFigure 1
  • EP3799398B1 patent drawingFigure 2
  • EP3799398B1 patent drawingFigure 3

AI summary

A domain name resolution request sent by a terminal is received. The domain name resolution request includes a domain name to be identified. The domain name includes at least one character. A sequence matrix corresponding to the domain name is determined. The sequence matrix includes at least one character vector. Each of the at least one character vector corresponds to each of the at least one character one to one. Each of the at least one character vector is sequentially input to an input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. A feature vector corresponding to the sequence matrix is obtained by performing logical operation processing on each of the at least one character vector based on the logical operation rule between the plurality of activation functions. Whether the domain name is a legal domain name is determined by inputting the feature vector corresponding to the sequence matrix to the domain name classification model.