Domain Name Tokenization for Maliciousness Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods face challenges in identifying malicious domain names, especially newly created ones with limited DNS records and sparse activity, as they require more features for accurate analysis, which existing analytics struggle to provide.
Innovation Solution
A computer-implemented method that splits domain names into tokens, combines them to form permutations, and identifies features using domain name databases to determine maliciousness, enabling threat analysis without relying on extensive prior knowledge or feature sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DNS analytics (DGA, phishing, WHOIS) are used to analyze domain names, then analysis can be performed with existing methods, but accurate identification of malicious domain names is difficult when limited features are available
Solution Approach 1:
The domain name is segmented into individual tokens (subdomains, domain names, TLDs) which can then be permuted independently. This segmentation allows the system to analyze components separately and recombine them to generate multiple feature variations from a single domain name, effectively increasing the quantity of analyzable features.
Solution Approach 2:
The patent transforms the one-dimensional domain name string into a multi-dimensional analysis space by creating permutations of tokens. This dimensional transformation allows the system to explore multiple feature combinations and arrangements, effectively increasing the feature space available for analysis without requiring additional input data.
2Measurement precision
If more features are required for accurate domain name analysis, then analysis accuracy can be improved, but existing analytics struggle to provide sufficient features for newly created domain names
Solution Approach 1:
The system performs preliminary tokenization and permutation of the domain name components before actual maliciousness analysis. By pre-processing the domain name into multiple token arrangements, the system creates a expanded feature set that can be analyzed even when the original domain name has limited historical data or DNS records.
Solution Approach 2:
The patent creates multiple copies of domain name tokens in different permutations and arrangements. These copied and rearranged tokens serve as additional feature representations that can be analyzed to detect malicious patterns, effectively multiplying the analytical value of the original limited data.
3Productivity
If domain names are analyzed using traditional methods, then existing analytics can be used, but newly created malicious domain names with sparse activity are difficult to detect
Solution Approach 1:
The system dynamically generates multiple token permutations from a single domain name, creating a flexible and adaptive analysis approach. This dynamic feature generation allows the system to adapt to new domain names without requiring pre-existing data, improving both detection efficiency and reliability for previously unseen malicious domains.
Data Source
AI summary
A computer implemented method analyzes a domain name. A number of processor units identifies the domain name for analysis. The number of processor units splits the domain name into tokens. The number of processor units combines the tokens into different arrangements to form permutated domain names. The number of processor units identifies features for the permutated domain names using a set of domain name databases. The number of processor units analyze the permutated domain names with the features to determine a maliciousness of the domain name.