Graph Prioritization for Threat Propagation Precision
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems are ineffective in detecting newly registered malicious network domains before they exhibit harmful behavior, as they rely on observed behavior rather than registration data, allowing malware to spread before being identified.
Innovation Solution
A method that generates a graph from domain registration data, identifies connected components meeting a graph robustness threshold, and uses a predictive model to determine the maliciousness of unobserved domains based on shared keys and known malicious or legitimate domains, applying network policies accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-malware systems rely on observed behavior to detect malicious domains, then detection accuracy is improved, but detection speed and proactive prevention deteriorate
Solution Approach 1:
The system performs preliminary analysis of domain registration data, graph connectivity, and robustness metrics before malicious behavior is observed. By pre-computing these features and establishing baseline profiles of legitimate domains, the system can rapidly evaluate new domains against these pre-established criteria, enabling proactive detection without waiting for harmful behavior to manifest.
Solution Approach 2:
The system transitions from analyzing single-dimension behavior data to multi-dimensional analysis by incorporating domain registration data, graph-theoretic connectivity metrics, and robustness thresholds. This dimensional expansion allows detection based on structural properties of domain relationships rather than solely on observed malicious behavior, enabling earlier identification of threats.
2Measurement precision
If graph robustness threshold is increased to improve detection precision, then false positives decrease, but detection coverage deteriorates
Solution Approach 1:
The system employs dynamic threshold adjustment where the graph robustness threshold is not fixed but adapted based on the specific characteristics of the domain under analysis, the connectivity of its component, and comparative metrics against known legitimate domains. This dynamic approach allows the threshold to be optimized for each evaluation context, maintaining high precision while preserving coverage.
Solution Approach 2:
The system changes the parameter of graph robustness threshold based on the specific component being evaluated. By adjusting this parameter dynamically according to the domain's position in the graph, its connectivity properties, and the overall structure of the domain registration data, the system optimizes the balance between precision and coverage for each detection decision.
3Reliability
If behavior analysis is used to tag domains as malicious, then reliability of detection is improved, but ability to detect new domains deteriorates
Solution Approach 1:
The system performs preliminary tagging of domains as legitimate or malicious based on graph connectivity and robustness analysis before behavioral observation is complete. By establishing these preliminary tags using structural properties of domain registration data, the system creates a proactive detection layer that does not depend on waiting for malicious behavior to be observed, thereby improving both reliability and adaptability to new domains.
Data Source
AI summary
Systems described herein preemptively detect newly registered network domains that are likely to be malicious before network behavior of the domains is actually observed. A network security device (e.g., a router) receives domain registration data that associates network domains with keys and generating a graph representing the domain registration data. Each edge of the graph connects a vertex representing a domain and a vertex representing a registration attribute (e.g., a registrant email address). The network security device identifies a connected component of the graph that meets a graph robustness threshold. The network security device determines whether a domain of the connected component whose behavior has not yet been observed is malicious using a predictive model based on existing maliciousness labels for other domains of the connected component.