Malicious Domain Detection Using DNS Interaction Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for detecting malicious domains in DNS are hindered by the need for large labeled datasets, manual feature selection, and the potential for attackers to evade detection due to inconsistent labeling and conflicting threat intelligence from multiple sources.
Innovation Solution
A graph neural network (GNN) is trained on a knowledge graph of DNS interactions, using embeddings and message passing to normalize threat intelligence and classify domains as malicious or benign, providing context for the classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional feature-based systems are used to detect malicious domains, then detection performance is acceptable, but the system requires large labeled datasets and manual feature selection which increases complexity and time consumption
Solution Approach 1:
The patent replaces manual feature selection and model training (mechanical processes) with a pre-trained language model that automatically extracts features from domain names through contextual understanding. The BERT model processes domain names directly without requiring manual feature engineering, thereby reducing system complexity while maintaining detection accuracy.
Solution Approach 2:
The patent uses pre-trained language models that have been copied and adapted from natural language processing domains to the cybersecurity domain. By leveraging pre-trained BERT models and fine-tuning them on cybersecurity datasets, the system avoids the need to train models from scratch, reducing both time and computational complexity.
2Ease of manufacture
If traditional systems treat each domain individually with manual statistical features, then the approach is simple to implement, but attackers can easily evade detection
Solution Approach 1:
The patent changes the parameter representation from simple statistical features (e.g., domain length, character frequency) to contextual embeddings generated by BERT. These embeddings capture semantic meaning and contextual relationships in domain names, making the detection system more reliable against evasion techniques while remaining implementable through automated processing.
Solution Approach 2:
The patent transitions from analyzing domains in isolation (one-dimensional approach) to analyzing domains within the context of their linguistic structure and semantic meaning (multi-dimensional approach). The BERT model processes domain names as sequences of tokens with contextual relationships, adding dimensional depth to the analysis and improving detection reliability.
3Quantity of substance
If multiple threat intelligence sources are used to improve detection coverage, then more threats are detected, but conflicting information from different sources increases false positives
Solution Approach 1:
The patent introduces a pre-trained language model as an intermediary layer between raw threat intelligence data and final detection decisions. The model processes and harmonizes information from multiple sources, using its contextual understanding to resolve conflicts and reduce false positives while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent performs preliminary processing and contextual analysis of threat intelligence data using pre-trained language models before making final detection decisions. By pre-processing the data through contextual embeddings and similarity calculations, the system prepares the information in a harmonized format that reduces conflicts and false positives during actual detection.
4Measurement precision
If large labeled datasets are used to train detection systems, then accuracy improves, but the labeling process becomes arduous and time-consuming
Solution Approach 1:
The patent performs preliminary training of language models on large corpora in advance, so that when deployed for malicious domain detection, the models already possess extensive linguistic knowledge and patterns. This preliminary action reduces the need for extensive labeling during the actual detection phase, saving time while maintaining accuracy.
Solution Approach 2:
The patent copies and leverages pre-trained language models that have already learned from vast amounts of textual data. By fine-tuning these pre-trained models on relatively small cybersecurity datasets, the system achieves high accuracy without requiring extensive manual labeling, as the models transfer knowledge from their pre-training.
Data Source
AI summary
Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.