Malicious Domain Detection via Tree-Based Neural Network
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious domains lack accuracy and efficiency, leading to potential security breaches and financial losses.
Innovation Solution
A method utilizing a trained tree-based neural network to process preprocessed network and domain word embeddings data, enhancing the accuracy and efficiency of malicious domain identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing methods for detecting malicious domains are used, then some security protection is provided, but the accuracy and efficiency of identification remain insufficient
Solution Approach 1:
The detection process is segmented into multiple independent stages: data extraction from various sources (WHOIS, DNS, Reverse PTR), data preprocessing (transforming sparse to dense representations), and classification using a trained neural network. This segmentation allows each stage to be optimized independently, improving both accuracy through comprehensive feature analysis and efficiency through parallel processing of different data types
Solution Approach 2:
The patent transforms domain data from sparse representations to dense vector representations through preprocessing. Domain names are converted into numerical vectors using techniques like word embeddings and TF-IDF, adding dimensional information that captures semantic meaning and contextual relationships, thereby significantly improving classification accuracy while maintaining processing efficiency
2Measurement precision
If comprehensive data extraction and processing is performed, then identification accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary data extraction and preprocessing in advance, creating a structured representation of domain features before final classification. By pre-processing data into dense vectors and organizing features in advance, the actual malicious domain identification process becomes faster and more efficient, as the prepared data can be directly fed into the trained neural network without time-consuming processing steps
Solution Approach 2:
The patent changes the representation parameters of domain data from sparse to dense formats. This parameter transformation allows the system to maintain comprehensive information for high accuracy while reducing the computational complexity of processing, as dense vectors can be processed more efficiently than sparse data structures in neural networks
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention relates to a method for calculating the probability of a domain being malicious based on an input data set for processing in a computer system, the method comprising, dataset extraction, comprising extraction of two types of input data, i.e. network data and claimable data. The method further comprises data preprocessing including transforming network data from dense to sparse as well as data preprocessing including transforming claimable data into vectorial representation. Finally, the method comprises data processing including processing the data through a trained tree-based neural network to determine the probability of a domain being malicious.