Malicious Domain Detection via Marginal Probability Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious domain access and infected hosts in large networks are resource-intensive and prone to delays, as they rely on extensive data analysis and manual intervention, making it difficult to prevent malware infections, especially in enterprise networks where modern malware can evade detection using techniques like system rootkits and honeypot-based analysis.
Innovation Solution
A method that constructs a graph of hosts and domains based on event datasets, using marginal probability estimation and belief propagation to infer the state of behavior of nodes, which allows for the detection of malicious domains and hosts without active interference, utilizing a subset of data such as DNS blacklists and event logs to identify malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If extensive data analysis and manual intervention are used to detect malicious domain access, then detection accuracy is improved, but resource consumption and detection delay increase
Solution Approach 1:
The patent pre-seeds the graph with known malicious and benign domain information before analysis begins. This preliminary action allows the belief propagation algorithm to start with informed priors rather than analyzing all data from scratch, reducing detection time while maintaining accuracy through pre-computed probability distributions.
Solution Approach 2:
The patent segments the network data into a graph structure where domains and hosts are separate nodes with probabilistic relationships. This segmentation allows parallel processing of belief propagation across different graph nodes, reducing overall computation time while maintaining detection accuracy through localized probability calculations.
2Reliability
If extensive data analysis is performed on large networks, then detection completeness is improved, but resource consumption increases
Solution Approach 1:
The patent applies belief propagation iteratively until convergence rather than requiring complete analysis of all possible data. This partial action approach achieves sufficient detection completeness by stopping when probability distributions stabilize, reducing resource consumption while maintaining reliability through probabilistic thresholds.
Solution Approach 2:
The patent transforms deterministic detection into probabilistic detection by using belief propagation to compute marginal probabilities. This parameter change from binary to probabilistic states allows efficient resource usage by enabling parallel computation and early termination when confidence thresholds are met, while maintaining detection completeness through probability aggregation.
3Measurement precision
If manual intervention is used in detection processes, then detection accuracy is improved, but automation level decreases
Solution Approach 1:
The patent implements self-service automation through belief propagation, where the system automatically computes detection probabilities by propagating beliefs across the graph structure without manual intervention. The algorithm autonomously converges to detection results by iteratively updating marginal probabilities based on seeded information and observed data, achieving both high automation and accuracy.
Solution Approach 2:
The patent incorporates feedback loops where detection results from one iteration inform the next iteration of belief propagation. The system uses computed marginal probabilities to update beliefs about malicious domains and hosts, creating automatic feedback that improves detection accuracy through iterative refinement without requiring manual review, thereby increasing automation while maintaining precision.
Data Source
AI summary
Systems, computer-readable media storing instructions, and methods can infer a state of behavior. Such a method can include constructing a graph including nodes representing hosts and domains based on an event dataset. The graph can be seeded with information external to the event dataset. A belief whether each of the nodes is in a particular state of behavior can be calculated based on marginal probability estimation.