Graph-Based Malicious Domain Detection via Global Associations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious domains are not robust, as attackers can easily alter features such as domain name patterns and Time To Live (TTL) to evade detection, making it difficult to distinguish between malicious and benign domains effectively.
Innovation Solution
A method and system that analyze global associations among domains using a graph-based approach, where domain nodes are connected based on relationships such as shared IP addresses and timestamp data, calculating a malicious score for each domain node to identify potential malicious domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional classification methods based on local DNS features are used, then domain detection can be performed, but the detection robustness deteriorates because attackers can easily alter features like domain name patterns and TTL to evade detection
Solution Approach 1:
The patent transitions from analyzing local domain features (1D) to analyzing global DNS query patterns across multiple domains and hosts (higher dimensions). By constructing graphs that capture relationships between domains, hosts, and DNS queries, the system moves to a multi-dimensional analysis space where attacker manipulations of individual domain features become less effective.
Solution Approach 2:
The patent introduces graph-based relationship structures as intermediaries between raw DNS data and classification results. These graphs serve as mediators that aggregate and contextualize DNS query patterns, making the detection system robust to individual feature manipulations by attackers.
2Reliability
If graph-based global association analysis is used, then detection robustness improves, but computational complexity increases
Solution Approach 1:
The patent segments the DNS analysis problem into multiple components: graph construction from DNS queries, relationship extraction, pattern identification, and classification. This segmentation allows each component to be optimized independently and processed in a pipeline fashion, reducing overall computational complexity.
Solution Approach 2:
The patent applies partial graph analysis by focusing on relevant subsets of DNS data and relationships rather than analyzing all possible domain combinations. This selective approach reduces computational complexity while maintaining detection robustness through targeted analysis of suspicious patterns.
Data Source
AI summary
Methods and systems for detecting malicious domains. The method comprises storing domain data for a plurality of domains and selecting a relationship parameter which represents a relationship between at least two of the domains. The method further comprises generating a graph for the domains by identifying a plurality of domain nodes, connecting the domain nodes with a plurality of edges and calculating an edge weight for each edge. The method further comprises identifying at least one domain node as a known malicious domain node and the other domain nodes as candidate domain nodes, calculating a malicious score for each candidate domain node based on the edge weights and identifying a domain in the plurality of domains as malicious if the malicious score is within a predetermined range.