Domain Reputation Classification via Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in quickly and accurately identifying new, uncategorized websites as malicious or benign, leading to poor user experience due to latency or ineffective protection, as threat intelligence feeds have latency and limited coverage for new domains.
Innovation Solution
The use of machine learning to determine domain reputation by analyzing various inputs such as lexical analysis, DomainRank, popularity, and historical Autonomous System Number (ASN)/WHOIS reputation, enabling near real-time classification of websites as malicious or benign and facilitating actions like phishing site detection and Command and Control (C2) detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threat intelligence feeds are used for reputation blocking, then known malicious sites can be blocked, but new malicious sites cannot be detected due to latency and limited coverage
Solution Approach 1:
The system performs preliminary analysis of new domains using multiple features (lexical analysis, DomainRank, popularity metrics, historical ASN/WHOIS reputation) before they can be used for malicious activities. This preliminary classification enables the system to proactively identify and block new malicious domains before they cause harm, rather than waiting for them to appear in threat intelligence feeds.
Solution Approach 2:
The patent introduces an intermediary machine learning classification system that sits between the domain request and the threat intelligence feed lookup. This intermediary performs rapid preliminary assessment using multiple features and only escalates to full threat intelligence checking when necessary, reducing the latency impact while maintaining detection accuracy.
2Reliability
If all new uncategorized sites are blocked, then malicious sites are protected, but legitimate new sites are also blocked causing poor user experience
Solution Approach 1:
The system applies different classification thresholds and analysis depths to different domains based on their risk characteristics. High-risk domains (those with suspicious lexical features, low DomainRank, poor historical reputation) undergo stricter scrutiny and are more likely to be blocked, while low-risk domains are quickly classified as benign and allowed through, providing differentiated protection that maintains user experience.
Solution Approach 2:
The patent dynamically adjusts classification parameters such as confidence thresholds, feature weights, and analysis depth based on the specific characteristics of each domain. This allows the system to optimize the balance between protection effectiveness and user experience for each individual domain rather than applying a uniform blocking policy.
3Measurement precision
If detailed scanning and analysis of new sites is performed, then accurate classification is achieved, but latency increases causing poor user experience
Solution Approach 1:
The system performs partial analysis using a subset of features (lexical analysis, DomainRank, popularity metrics) for initial classification. Only domains that exceed certain risk thresholds trigger more extensive analysis including full page scanning and deeper reputation checks. This partial action approach achieves sufficient classification accuracy for most domains while minimizing latency.
Solution Approach 2:
The analysis process is segmented into multiple stages: rapid feature extraction and initial classification, followed by conditional deeper analysis only for suspicious domains. This segmentation allows the system to achieve high accuracy for clear-cut cases quickly while reserving detailed analysis resources for ambiguous cases that require more scrutiny.
4Ease of operation
If no protection is provided for new sites, then user experience is maintained, but ineffective protection is provided against malicious sites
Solution Approach 1:
The system provides automatic classification and protection for new domains without requiring user intervention or manual reporting. The machine learning model autonomously evaluates each new domain using multiple features and applies appropriate protection measures, making the system self-protecting while maintaining seamless user experience.
Data Source
AI summary
Systems and methods include receiving a domain for a determination of a likelihood the domain is malicious or benign; obtaining data associated with the domain including log data from a cloud-based system that performs monitoring of a plurality of users; analyzing the domain with a plurality of components to assess the likelihood, wherein at least one of the plurality of components is a trained machine learning model; and combining results of the plurality of components to predict the likelihood the domain is malicious or benign.