Malicious Domain Detection via Multi-Type Prediction Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious domain names in a DNS are inefficient, requiring manual analysis and being unable to keep pace with the rapid generation of new domain names.
Innovation Solution
A detection method and device that utilize network connection data to capture log data, analyze features related to domain name mappings and IP address changes, and input these features into a multi-type prediction model to predict the presence of malicious domain names, specifically distinguishing between malware and phishing websites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual reverse engineering is used to detect malicious domain names, then detection accuracy can be maintained, but detection efficiency and speed are severely limited
Solution Approach 1:
The patent replaces manual reverse engineering (mechanical human analysis) with an automated machine learning system. The system automatically extracts features from domain names, queries multiple data sources, and uses trained models to detect malicious domain names, eliminating the time-consuming manual analysis process while maintaining high detection accuracy
Solution Approach 2:
The system enables self-service detection by automatically performing all detection tasks without human intervention. The machine learning models continuously learn from new data and automatically update detection capabilities, allowing the system to serve itself in identifying and adapting to new malicious domain patterns
2Reliability
If continuous updating of malicious domain name lists is performed, then detection coverage is improved, but the speed cannot keep pace with the rapid generation of new domain names
Solution Approach 1:
The system performs preliminary action by pre-training machine learning models on extensive historical data and multiple feature sources before actual detection is needed. This allows the system to immediately detect new malicious domain names using pre-established patterns, rather than waiting for manual analysis or list updates
Solution Approach 2:
The system uses parameter changes by analyzing multiple varying features of domain names (characteristics, registration data, network behavior) rather than relying on static domain name lists. The machine learning models evaluate multiple parameters simultaneously to identify malicious patterns, enabling rapid adaptation to new threats
3Productivity
If automated detection systems are implemented, then detection speed is improved, but the ability to distinguish between different types of malicious activities (malware vs phishing) becomes more complex
Solution Approach 1:
The patent applies segmentation by dividing the detection task into separate specialized models: one model trained specifically for malware detection and another for phishing detection. Each model focuses on specific features and patterns relevant to its threat type, making the overall system more manageable and interpretable despite the complexity of detecting multiple threat types
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection method for a malicious domain name in a domain name system (DNS) and a detection device (1) are provided. The method includes: obtaining network connection data (21) of an electronic device (12); capturing log data (22, 23) related to at least one domain name from the network connection data (21); analyzing the log data (22, 23) to generate at least one numerical feature related to the at least one domain name; inputting the at least one numerical feature into a multi-type prediction model, which includes a first data model and a second data model; and predicting whether a malicious domain name related to a malware or a phishing website exists in the at least one domain name by the multi-type prediction model according to the at least one numerical feature.