Hardware-Accelerated DGA Detection via Memory Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions for detecting malicious activities such as ransomware, malicious URLs, and DGA malware are inadequate as they rely on static analysis and external monitoring, failing to detect new unknown malware and encrypted or obfuscated threats, and are evaded by malware.
Innovation Solution
A hardware-accelerated security service on an integrated circuit uses a machine learning detection system to inspect memory for malicious activity, employing random-forest classification models for ransomware, binary classification models for malicious URLs, and two-stage classification models for DGA malware, allowing for real-time detection of threats even when they are encrypted or obfuscated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis and external monitoring are used for detecting malicious activities, then current security solutions can identify known threats, but they fail to detect new unknown malware and encrypted or obfuscated threats
Solution Approach 1:
The patent changes the detection parameters from static analysis to dynamic memory inspection. By monitoring memory snapshots and extracting features such as string patterns, character distributions, and memory access behaviors, the system can detect both known and unknown malware variants, including encrypted and obfuscated threats that evade static analysis.
Solution Approach 2:
The patent replaces traditional mechanical security systems (static analysis, signature-based detection) with a machine learning-based dynamic inspection system. The ML model processes memory snapshots and extracts behavioral features to classify malicious activities, enabling detection of previously unknown malware and encrypted threats.
2Ease of manufacture
If traditional security solutions are used, then existing infrastructure can be maintained, but malware can evade detection and new threats cannot be identified
Solution Approach 1:
The patent performs preliminary inspection of memory snapshots before malware can execute harmful actions. By continuously monitoring memory and extracting features in advance, the system can identify malicious activities before they manifest, enabling proactive detection rather than reactive response.
Solution Approach 2:
The patent introduces an intermediary layer between the host system and the detection mechanism. A security service inspects memory snapshots and extracts features, which are then fed to an ML model for classification. This intermediary approach maintains system functionality while providing intelligent detection.
3Productivity
If memory inspection and machine learning classification are implemented, then detection rate and efficiency are improved, but computational resources and processing complexity increase
Solution Approach 1:
The patent segments the detection process into distinct stages: memory snapshot extraction, feature extraction, and ML classification. By dividing the complex task into manageable segments, the system can process memory efficiently while maintaining high detection accuracy, reducing the computational burden on any single component.
Solution Approach 2:
The patent extracts only the necessary features from memory snapshots rather than processing all data. By selecting relevant features such as string patterns, character distributions, and memory access behaviors, the system achieves effective detection while minimizing computational resources required for processing.
Data Source
AI summary
Apparatuses, systems, and techniques for classifying one or more candidate uniform resource locators (URLs) as having a domain generation algorithm (DGA) domain using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being domain characters in one or more candidate URLs. The security service classifies, using the ML detection system, the one or more candidate URLs as having a DGA domain or a non-DGA domain using the set of features. The security service outputs an indication of a DGA malware responsive to the one or more candidate URLs being classified as having the DGA domain.