Network Object Classification via Association Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious network nodes that distribute malware are inadequate as they primarily rely on WHOIS and DNS information, failing to consider other critical factors such as URI associations and generic information about domain names, which limits their effectiveness in preventing the spread of malicious activity.
Innovation Solution
A method and system that classify objects by generating a graph of associations between objects with generic information, using machine learning models for analysis, and restricting access to malicious objects to prevent the spread of malicious activity, incorporating similarity analysis and sequential or group association analysis to identify unclassified objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If only WHOIS and DNS information is used for classifying malicious domains, then the classification method is simple and easy to implement, but the classification accuracy and effectiveness are insufficient
Solution Approach 1:
The patent segments the classification process into multiple independent modules: graph generation module that creates association graphs from multi-source data, subgraph extraction module that identifies homogeneous object groups, classification module that applies machine learning models, and restriction module that blocks malicious objects. Each module handles a specific aspect of the classification task, improving accuracy while maintaining manageable system complexity through modular design.
Solution Approach 2:
The patent combines multiple types of information sources (WHOIS data, DNS records, URI associations, domain name generic information) into a composite association graph structure. This composite approach integrates heterogeneous data types with different characteristics, allowing the system to leverage the strengths of each information source while compensating for their individual limitations, thereby achieving higher classification accuracy.
2Reliability
If multi-factor analysis including URI associations and generic information is implemented, then the classification effectiveness improves, but the computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary actions by pre-generating association graphs from multi-source data and pre-identifying homogeneous object groups before actual classification is needed. The graph generation and subgraph extraction are prepared in advance, so when classification is required, the system only needs to apply the machine learning model to pre-processed data structures, significantly reducing real-time processing time while maintaining high effectiveness.
Solution Approach 2:
The patent extracts only the relevant subgraphs containing homogeneous objects from the complete association graph, rather than processing the entire graph. This extraction focuses computational resources on the specific subsets of data that are most relevant to the classification task, reducing the amount of data that needs to be processed and thereby decreasing processing time while preserving classification effectiveness.
3Adaptability or versatility
If comprehensive object association analysis is performed to identify all malicious nodes, then the coverage of malicious activity detection improves, but the false positive rate may increase
Solution Approach 1:
The patent applies different analysis methods and classification rules to different local regions (subgraphs) of the association graph based on their specific characteristics. Homogeneous object groups that show strong malicious patterns receive more aggressive classification, while regions with ambiguous associations undergo more careful evaluation. This localized approach allows comprehensive detection coverage while reducing false positives by adapting the classification strictness to the local evidence quality.
Solution Approach 2:
The system implements feedback mechanisms where classification results are used to refine and update the association graphs and classification rules. Misclassified objects (false positives) provide feedback that triggers rule adjustments and re-evaluation, allowing the system to learn from errors and improve precision over time while maintaining high detection coverage through continuous adaptation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for classifying objects to prevent the spread of malicious activity. An exemplary method comprises: searching for objects in a network that have generic information with other objects and collecting information about the objects, generating a graph of associations containing classified and unclassified objects in a form of vertices, whereby an association between objects indicates a presence of generic information between the objects, wherein the classified objects comprise malicious objects, extracting from the generated graph of associations at least one subgraph comprising homogeneous objects and containing at least one unclassified object based on at least one of the following: an analysis of the group association between objects; and an analysis of sequential association between objects, classifying each unclassified object in each subgraph based on the analysis using classification rules, and restricting access to an object that is classified as malicious.