Malicious Domain Detection via Tree-Based Neural Network

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting malicious domains lack accuracy and efficiency, leading to potential security breaches and financial losses.

Innovation Solution

A method utilizing a trained tree-based neural network to process preprocessed network and domain word embeddings data, enhancing the accuracy and efficiency of malicious domain identification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing methods for detecting malicious domains are used, then some security protection is provided, but the accuracy and efficiency of identification remain insufficient

Engineering Contradiction:
Improveaccuracy of malicious domain identificationVSAvoidefficiency of domain detection process
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The detection process is segmented into multiple independent stages: data extraction from various sources (WHOIS, DNS, Reverse PTR), data preprocessing (transforming sparse to dense representations), and classification using a trained neural network. This segmentation allows each stage to be optimized independently, improving both accuracy through comprehensive feature analysis and efficiency through parallel processing of different data types

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent transforms domain data from sparse representations to dense vector representations through preprocessing. Domain names are converted into numerical vectors using techniques like word embeddings and TF-IDF, adding dimensional information that captures semantic meaning and contextual relationships, thereby significantly improving classification accuracy while maintaining processing efficiency

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Measurement precision

If comprehensive data extraction and processing is performed, then identification accuracy improves, but processing time and computational resources increase

Engineering Contradiction:
Improveaccuracy of malicious domain identificationVSAvoidprocessing time for domain analysis
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary data extraction and preprocessing in advance, creating a structured representation of domain features before final classification. By pre-processing data into dense vectors and organizing features in advance, the actual malicious domain identification process becomes faster and more efficient, as the prepared data can be directly fed into the trained neural network without time-consuming processing steps

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent changes the representation parameters of domain data from sparse to dense formats. This parameter transformation allows the system to maintain comprehensive information for high accuracy while reducing the computational complexity of processing, as dense vectors can be processed more efficiently than sparse data structures in neural networks

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP4293956B1Method for predicting malicious domains
Publication Date: 2025.05.21 HEIMDAL SECURITY AS
  • EP4293956B1 patent drawingFigure 1~2
  • EP4293956B1 patent drawingFigure 3~4
  • EP4293956B1 patent drawingFigure 5~6

AI summary

The invention relates to a method for calculating the probability of a domain being malicious based on an input data set for processing in a computer system, the method comprising, dataset extraction, comprising extraction of two types of input data, i.e. network data and claimable data. The method further comprises data preprocessing including transforming network data from dense to sparse as well as data preprocessing including transforming claimable data into vectorial representation. Finally, the method comprises data processing including processing the data through a trained tree-based neural network to determine the probability of a domain being malicious.