Domain Risk Scoring for Autonomous System Vulnerability Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting malicious content and vulnerabilities in domains associated with autonomous systems are inefficient, slow, and incomplete, requiring significant computing resources and lacking effective prioritization.
Innovation Solution
A classification system that extracts features from domain names using machine learning techniques to assign a risk priority score, prioritizing domains for scanning based on these scores, and a scanner system that performs targeted scans to identify malicious content and vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all domains associated with an autonomous system are scanned individually, then complete detection of malicious content and vulnerabilities is achieved, but the scanning process becomes extremely slow and consumes significant computing resources
Solution Approach 1:
The patent segments the domain scanning task by dividing domains into priority groups based on risk scores. Instead of scanning all domains uniformly, the system segments them into high-priority (higher risk scores) and lower-priority domains, scanning the most critical ones first to achieve timely detection of malicious content while reducing overall scanning time and resource consumption.
Solution Approach 2:
The patent applies preliminary action by performing feature extraction and risk score calculation on all domains before the actual scanning process. This preliminary classification based on machine learning models allows the system to prioritize which domains to scan first, ensuring that resources are allocated efficiently to the most vulnerable domains while maintaining detection completeness.
2Reliability
If traditional scanning methods are used without prioritization, then all domains are eventually detected, but the process requires significant computing resources and time
Solution Approach 1:
The patent applies local quality by assigning different scanning priorities to different domains based on their individual risk characteristics. Instead of uniform scanning, each domain receives a risk score that determines its scanning priority, allowing the system to concentrate computational resources on domains with higher vulnerability potential while reducing resources allocated to lower-risk domains.
Solution Approach 2:
The patent changes the parameter of scanning priority by introducing risk scores derived from machine learning models. This parameter change transforms the scanning process from a uniform approach to a differentiated approach where domains are scanned based on their calculated risk levels, optimizing resource utilization while maintaining detection effectiveness.
3Productivity
If machine learning-based classification is implemented to prioritize domains, then scanning efficiency is improved and resource usage is reduced, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary classification system that sits between domain identification and the scanning process. This intermediary layer uses machine learning models to calculate risk scores and determine scanning priorities, effectively mediating between the raw domain data and the scanning execution. While this adds a layer of complexity, it significantly improves scanning efficiency by ensuring that resources are focused on the most vulnerable domains.
Data Source
AI summary
In an embodiment, a data processing method providing an improvement in computer security, comprises selecting, from a domain name queue comprising a plurality of domain names, a particular domain name to analyze; extracting one or more features of the particular domain name; determining a particular risk priority score of the particular domain name based on analyzing the one or more features of the particular domain name by applying a classifier to the one or more features of the particular domain name; inserting the particular risk priority score and an identifier associated with the particular domain name into a priority queue comprising a plurality of risk priority scores and a plurality of domain names; repeating the selecting, extracting, determining, and inserting steps for the remaining domain names in the domain name queue; retrieving from the priority queue, based upon the risk priority score, the identifier associated with the particular domain name; determining the particular domain name associated with the identifier; scanning the particular domain name for malicious content or security vulnerabilities; and outputting results of the scanning to a system, database, or report.