Malware Domain Detection via Credibility Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer security techniques for detecting malware domain names are time-consuming and resource-intensive, requiring extensive reverse engineering of domain generation algorithms, which are difficult to scale for new malware threats.
Innovation Solution
A system and method for monitoring and recognizing problematic domain names by scanning URLs for malware attributes using a malicious-code dataset, without the need for reverse engineering, and updating a blacklist record based on credibility scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional computer security techniques are used to detect malware domain names by comparing each domain name against every dictionary word, then detection thoroughness is improved, but detection time increases to 24-36 hours and resource consumption increases
Solution Approach 1:
The patent segments the domain name analysis into multiple independent components: character frequency analysis, n-gram pattern matching, entropy calculation, and lexical database comparison. Each component processes specific features independently and contributes to the overall credibility score, replacing the exhaustive brute-force approach with parallelizable sub-tasks that can be executed efficiently.
Solution Approach 2:
The patent transforms the detection problem from exact string matching against dictionary words to a multi-parameter credibility scoring system. It evaluates domain names based on character frequency distributions, n-gram patterns, entropy values, and lexical database matches, assigning weights to each parameter to generate an overall credibility score that determines whether a domain is malicious.
2Measurement precision
If reverse engineering of domain generation algorithms is performed to detect malware domains, then detection accuracy for specific malware is improved, but the process becomes time-intensive requiring months of effort and is not scalable to new malware threats
Solution Approach 1:
The patent implements a self-service detection system that automatically analyzes domain names using predefined credibility criteria without requiring manual reverse engineering. The system autonomously evaluates character frequencies, n-gram patterns, entropy, and lexical matches to generate credibility scores, enabling rapid detection of both known and novel malware domains without human intervention or algorithm reverse engineering.
Solution Approach 2:
The patent creates a universal detection framework that handles diverse malware domain generation algorithms through a single multi-functional system. The credibility scoring mechanism evaluates multiple linguistic and structural features simultaneously, making it adaptable to various malware families and domain generation strategies without requiring separate reverse engineering efforts for each threat.
3Object-affected harmful factors
If malware designers use randomly generated domain names with anomalous alphanumeric sequences, then malware domain identification becomes more difficult, but such domains are easier to detect using statistical analysis of character distributions
Solution Approach 1:
The patent applies statistical analysis to detect subtle anomalies in domain name character distributions, effectively identifying malicious domains that appear random. By calculating character frequencies, n-gram patterns, and entropy values, the system detects deviations from normal domain name statistics, revealing hidden patterns in supposedly random malware domains that human analysts or simple filters would miss.
Data Source
AI summary
Disclosed herein are systems and methods of executing scanning software, such an executable software program or script (e.g., PowerShell script), by a computing device of an enterprise, such as a security server, may instruct the computing device to search all or a subset of computing devices in an enterprise network. The scanning software may identify PowerShell scripts containing particular malware attributes, according to a malicious-code dataset. The computing system executing the scanning software may scan through the identified PowerShell scripts to identify particular strings, values, or code-portions, and take a remedial action according to the scanning software programming.