Graph-Based Object Classification for Malicious Network Node Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious network nodes that distribute malware are inadequate as they primarily rely on WHOIS and DNS information, failing to consider other critical factors such as URI associations and generic information about objects, which limits their effectiveness in preventing the spread of malicious activity.
Innovation Solution
A method and system that classify objects by generating a graph of associations between objects with generic information, using machine learning models for analysis, and restricting access to malicious objects to prevent the spread of malicious activity, involving similarity analysis and sequential or group association analysis to identify and classify unclassified objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional WHOIS and DNS information analysis is used to identify malicious network nodes, then the method is simple to implement, but the identification accuracy and effectiveness are insufficient
Solution Approach 1:
The patent segments the identification process into multiple independent modules: graph construction module, subgraph extraction module, classification module, and blocking module. Each module handles a specific aspect of the analysis, allowing the system to process complex multi-factor data while maintaining manageable system architecture and improving identification accuracy through specialized processing at each stage.
Solution Approach 2:
The patent transitions from traditional single-dimensional WHOIS/DNS analysis to multi-dimensional analysis by constructing a graph structure that incorporates diverse object types (domains, IPs, URIs, emails) and their associations. This dimensional expansion enables comprehensive analysis of malicious patterns across multiple factors simultaneously, significantly improving identification accuracy.
2Reliability
If comprehensive multi-factor analysis including URI associations and generic information is implemented, then the effectiveness in preventing malicious activity spread is improved, but the computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary actions by pre-construction of the association graph structure and pre-extraction of subgraphs containing potential malicious patterns. This preparation work is done before actual classification and blocking operations, allowing the system to quickly process and respond to malicious activity using pre-computed structural information, thereby reducing real-time processing delays.
Solution Approach 2:
The patent replaces traditional mechanical scanning and analysis methods with intelligent algorithms including machine learning models and pattern recognition systems. These intelligent systems automatically analyze complex multi-factor associations in the graph structure, significantly improving processing efficiency and reducing the time required to identify and respond to malicious activity while maintaining high reliability.
3Measurement precision
If graph-based association analysis with multiple object types is used, then the ability to identify hidden malicious nodes is improved, but the data processing complexity increases
Solution Approach 1:
The patent introduces an intermediary classification system that acts as a mediator between the complex multi-type object graph and the final blocking decisions. The classification module processes various object types (domains, IPs, URIs, emails) through unified classification rules and machine learning models, simplifying the handling of heterogeneous data while maintaining high detection capability for hidden malicious nodes.
Solution Approach 2:
The patent implements a universal graph structure and classification framework that can handle multiple object types (domains, IP addresses, URIs, emails) simultaneously. This multi-functional approach allows the system to analyze diverse data types through a single unified process, reducing data processing complexity compared to maintaining separate analysis systems for each object type while preserving comprehensive detection capability.
Data Source
AI summary
Disclosed herein are systems and methods for classifying objects to prevent the spread of malicious activity. In one aspect, an exemplary method comprises: searching for objects in a network that have generic information with other objects and collecting information about the objects, generating a graph of associations containing classified and unclassified objects in a form of vertices, whereby an association between objects indicates a presence of generic information between the objects, wherein the classified objects comprise malicious objects, extracting from the generated graph of associations at least one subgraph comprising homogeneous objects and containing at least one unclassified object based on at least one of the following: an analysis of the group association between objects; and an analysis of sequential association between objects, classifying each unclassified object in each subgraph based on the analysis using classification rules, and restricting access to an object that is classified as malicious.