Domain Classification via Temporal Co-occurrence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems face challenges in effectively identifying and blocking malicious domains, as they rely on traditional block lists that may not capture time-related relationships between domains in client request behavior, leading to potential missed detections of malware distribution and data collection activities.
Innovation Solution
The system generates domain classification based on co-occurrence information derived from client request behavior, analyzing time differences between requests to determine relatedness between domains, and uses this information to classify unknown domains by comparing their co-occurrence with known malicious domains, thereby enhancing the detection of suspicious or malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional block lists are used to identify malicious domains, then the system is simple to operate, but the detection accuracy is insufficient because time-related relationships between domains are not captured
Solution Approach 1:
The patent transitions from traditional static block lists to a multi-dimensional analysis system that incorporates time-based co-occurrence relationships. By analyzing when domains are requested together across multiple clients, the system adds a temporal dimension to domain classification, significantly improving detection accuracy while managing complexity through automated computational methods.
Solution Approach 2:
The system automatically generates domain classifications by analyzing client request behavior patterns without requiring manual updates to block lists. The automated analysis of co-occurrence information and time-based relationships enables the system to self-update its classification data, improving detection accuracy while reducing the operational burden of manual list maintenance.
2Measurement precision
If co-occurrence analysis based on client request behavior is implemented, then the accuracy of identifying malicious domains is improved, but the computational complexity and data processing requirements increase
Solution Approach 1:
The system performs preliminary analysis of client request behavior to pre-compute co-occurrence information and time-based relationships between domains. By preparing classification data in advance through automated analysis of request patterns, the system improves detection accuracy while managing computational complexity through structured data preparation rather than real-time complex calculations.
3Reliability
If time-based co-occurrence information is analyzed to classify domains, then malware distribution detection is enhanced, but the time required for data collection and analysis increases
Solution Approach 1:
The system continuously collects and analyzes client request behavior data in the background, maintaining an up-to-date understanding of domain co-occurrence relationships over time. This continuous operation enables the system to improve malware detection reliability through ongoing analysis without requiring lengthy batch processing, as the classification data is progressively refined through sustained data collection.
Data Source
AI summary
Domain classification based on domain co-occurrence information derived from client request behavior is provided. The network requests of clients are analyzed to determine domain and time information. Distance information is generated based on the time between requests for a plurality of domains. The distance information for individual clients is combined to generate distance information for domain pairs. The distance information represents an amount of time or other measurement between queries associated with the two domains of the pair. By examining the client requests, a measure of the distance or relatedness of two domains may be determined. Co-occurrence information for a first set of domains is generated based on the co-occurrence of domains in the first set with domains in a second set of domains. Based on the co-occurrence information, a domain classification can be generated for domains in the first set of domains.