Domain Name Suspiciousness Scoring for Malicious Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for detecting malicious domain names in network traffic are inefficient and have a low probability of detecting infected devices, leading to inadequate protection against botnets and other malicious activities.
Innovation Solution
A computing device equipped with a communication module, filtering module, analyzing module, and processing module that extracts and analyzes domain names from network traffic using various analysis methods to generate a numerical value representing suspiciousness, classifying domain names as malicious based on features such as length, popularity, entropy, and meaningfulness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current detection systems are used to analyze domain names in network traffic, then the system can operate with simple mechanisms, but the probability of detecting malicious domain names is low
Solution Approach 1:
The patent segments the domain name analysis into multiple independent analysis methods (statistical analysis, entropy analysis, N-gram analysis, language model analysis). Each method processes domain names separately and generates scores that are combined to produce a final maliciousness determination. This segmentation allows the system to achieve high detection reliability through multiple perspectives while maintaining manageable complexity by modularizing each analysis component.
Solution Approach 2:
The patent merges multiple analysis methods (statistical features, entropy calculations, N-gram frequencies, language model probabilities) into a unified detection system. By combining the results of these different analysis approaches, the system achieves higher detection reliability than any single method could provide alone, while the modular architecture keeps the overall system complexity controlled.
2Measurement precision
If multiple analysis methods are applied to each domain name, then the detection accuracy improves, but the computational resources required increase
Solution Approach 1:
The patent implements a scoring system where each analysis method contributes a partial score toward the final maliciousness determination. The system can adjust the weight of each analysis method and set threshold values to achieve the desired detection accuracy while controlling computational resource consumption. This allows the system to apply multiple analysis methods partially, focusing computational effort on the most informative features.
Solution Approach 2:
The patent changes parameters such as the weight coefficients of different analysis methods, threshold values for maliciousness determination, and the specific features analyzed (e.g., N-gram size, entropy thresholds). By optimizing these parameters, the system achieves high detection accuracy while controlling the computational resources required for each analysis method.
3Measurement precision
If comprehensive analysis of domain name features is performed, then the classification accuracy improves, but the processing time increases
Solution Approach 1:
The patent performs preliminary analysis by extracting statistical features, entropy values, and N-gram frequencies from domain names before applying the language model analysis. These preliminary results are cached and reused in the final classification stage, avoiding redundant computations. This preliminary action maintains high classification accuracy while reducing the overall processing time by eliminating repeated calculations.
Solution Approach 2:
The patent implements a continuous scoring system where each analysis method contributes incrementally to the final maliciousness score. Rather than performing discrete, time-consuming analysis steps, the system continuously accumulates evidence from multiple analysis methods, allowing for early termination when sufficient confidence is achieved, thus maintaining accuracy while reducing processing time.
Data Source
AI summary
There are disclosed a method and computing device for detecting malicious domain names in network traffic. The method comprises: receiving the network traffic from a data network, extracting a plurality of data packets from the network traffic, analyzing the plurality of data packets in order to extract at least one domain name from the plurality of data packets; generating, for a given one of the at least one domain names, a given numerical value representative of a suspiciousness of the given one of the at least one domain name, the given numeric value being based on a given set of features of domain name suspiciousness corresponding to one of the given set of analysis methods; classifying the at least one domain name as malicious domain names, in response to an analysis being indicative the given domain name being a malicious domain name.