Domain Reputation Scoring via Graph Database Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious network activities, such as web-based security threats and botnets, face challenges in detecting fleeting and evolving security threats due to adaptive coding techniques and changing command and control server locations, making it difficult to maintain effective security measures.
Innovation Solution
A computer-implemented method for domain name scoring using a graph database that extracts features from input data, including network parameters, owner information, and web traffic, and employs machine-learning classifiers to calculate a reputation score, propagating maliciousness from known nodes to unknown nodes, facilitating the detection of malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS resolution methods are used to identify malicious activities, then the system is simple to operate, but it cannot detect fleeting and evolving security threats due to adaptive coding techniques and changing C&C server locations
Solution Approach 1:
The system pre-calculates and stores reputation scores for domains, IP addresses, and other network entities in advance using machine learning models trained on historical data. When a DNS query arrives, the system quickly retrieves pre-computed scores rather than analyzing everything in real-time, enabling fast detection of threats while maintaining system simplicity.
Solution Approach 2:
The patent introduces reputation scores as an intermediary metric between raw DNS data and threat detection. Instead of directly analyzing malicious patterns in real-time, the system uses pre-computed reputation scores of domains, IP addresses, and certificates as mediators to infer potential threats, simplifying the detection process while improving reliability.
2Measurement precision
If machine learning models are trained on large datasets to improve threat detection accuracy, then detection precision improves, but training time and computational resources increase
Solution Approach 1:
The system performs machine learning model training and dataset processing in advance, storing the trained models and extracted features for later use. This preliminary action allows the system to achieve high detection precision without incurring training time delays during actual threat detection operations.
Solution Approach 2:
The patent segments the machine learning process into distinct phases: offline training phase where models are trained on large datasets, and online inference phase where pre-trained models quickly evaluate new data. This segmentation allows intensive computational work to be done in advance while maintaining fast response times for actual threat detection.
3Reliability
If the system continuously updates security measures to counter adaptive malware, then detection effectiveness improves, but maintenance costs and infrastructure requirements increase
Solution Approach 1:
The system automatically updates its machine learning models and reputation scores by continuously processing new data without requiring manual intervention. The machine learning models self-adapt to new threat patterns by learning from incoming DNS query data, reducing maintenance costs while maintaining detection effectiveness against evolving malware.
Solution Approach 2:
The patent implements dynamic reputation scoring where scores are continuously updated based on new information about domains, IP addresses, and network entities. This dynamic approach allows the system to adapt to changing threat landscapes automatically, maintaining high detection effectiveness without proportionally increasing maintenance burden.
Data Source
AI summary
The disclosure is related to computer-implemented methods for domain name scoring. In one example, the method includes receiving a request to provide a reputation score of a domain name, receiving input data associated with the domain name, extracting a plurality of features from the input data and the domain name, generating a feature vector based on the plurality of features, and calculating the reputation score of the domain name by a machine-learning classifier based on a graph database, which includes feature vectors associated with at least a plurality of reference domain names, a plurality of servers, a plurality of domain name owners, and so forth. In another example, the method can calculate the reputation score by finding a similarity between the feature vector and one of domain name clusters in the graph database. The reputation score represents a probability that the domain name is associated with malicious activity.