Domain Reputation Clustering for Zero-Day Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web reputation systems face challenges in keeping up with accurate reputations for newly registered URLs, leading to users being at risk of visiting malicious sites, especially during mass domain registrations or trending events, as they struggle to process hundreds of thousands to millions of URLs in real time and often encounter unknown reputations.
Innovation Solution
A system that clusters newly registered domain names based on textual similarity and temporal proximity, assigns a consensus reputation to clusters with a majority of bad reputations, and temporarily marks unknown domains within these clusters as untrusted, providing instant protection without additional costs, using a sliding window approach and symmetric spelling correction algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional web reputation systems process URLs individually, then measurement precision of reputation is maintained, but productivity is insufficient to keep up with mass domain registrations
Solution Approach 1:
The patent merges multiple similar domain names into clusters based on textual similarity and temporal proximity. By treating clustered domains as a group rather than individual entities, the system can assign a single consensus reputation to multiple domains simultaneously, dramatically increasing processing throughput while maintaining reliability through the consensus mechanism that evaluates multiple domains together.
Solution Approach 2:
The patent segments the vast set of newly registered domains into smaller, manageable clusters based on similarity criteria. This segmentation allows the reputation system to process clusters in batches rather than individually handling each domain, improving productivity while preserving measurement precision through the consensus evaluation of each cluster.
2Reliability
If web reputation systems analyze all newly registered URLs in real time, then reliability of reputation assessment is improved, but loss of time increases due to the sheer volume of URLs
Solution Approach 1:
The patent performs preliminary clustering of domain names based on textual similarity and registration time before reputation assessment. By pre-grouping domains into clusters, the system reduces the scope of subsequent reputation analysis, enabling faster processing without sacrificing reliability since the consensus mechanism still evaluates multiple domains within each cluster.
Solution Approach 2:
The patent applies partial action by focusing reputation analysis on clusters rather than every individual domain. This selective approach processes a representative subset of domains (the cluster) to derive reputations that can be assigned to multiple domains simultaneously, reducing overall processing time while maintaining adequate reliability through the consensus mechanism.
3Measurement precision
If web reputation systems process every new URL independently, then measurement precision is maintained, but device complexity increases due to processing volume
Solution Approach 1:
The patent combines multiple domain processing operations into a single cluster-based evaluation. By merging similar domains into clusters and assessing them together through a consensus mechanism, the system reduces computational complexity while preserving measurement precision through the collective evaluation of multiple domains within each cluster.
4Reliability
If web reputation systems wait for traditional analysis of all domains, then reliability of reputation is ensured, but loss of time increases leaving users vulnerable
Solution Approach 1:
The patent performs preliminary clustering and consensus reputation assignment before traditional individual domain analysis is complete. This preliminary action provides immediate reputation information to protect users from malicious sites, while the consensus mechanism ensures adequate reliability by evaluating multiple domains together. Traditional analysis can subsequently supersede these preliminary assignments if needed.
Solution Approach 2:
The patent applies preliminary anti-action by proactively assigning reputations to clustered domains based on consensus evaluation before malicious activity can fully exploit the time delay. This preliminary protection mechanism counteracts the vulnerability that would otherwise exist during the waiting period for traditional analysis, reducing user exposure time while maintaining sufficient reliability through the consensus approach.
Data Source
AI summary
There is disclosed an example of one or more tangible, non-transitory computer-readable storage media, including instructions to: enumerate domain names newly registered in a time window; build a dictionary from the newly registered domain names; cluster the domain names, including performing a spell check with the dictionary to identify similar domain names; for a selected cluster, identify one or more domain names with an assigned reputation; and if a portion of assigned reputations exceeds a threshold of bad reputations, assign cluster-based bad reputations to domains in the cluster with unknown reputations.