Root Domain Benignity Evaluation Using AI and Metadata Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for domain name evaluation fail to effectively address the challenges of differentiating between malicious domain names and existing methods for domain name evaluation, particularly in the context of malicious domain names that mimic legitimate ones for phishing and other malicious purposes, leading to false positive detections and challenges in differentiating between attacker-owned and temporarily compromised benign domains.
Innovation Solution
A root domain evaluation service that leverages a language model to evaluate benignity by prompting with task instructions and combines feature values from metadata and the language model's output, using a classification pipeline with a trained classifier and heuristic analyzer to provide a final verdict on domain benignity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static allowlists and blocklists are used for domain name evaluation, then false positive detections are reduced, but the system lacks flexibility and cannot effectively differentiate between malicious domains and temporarily compromised benign domains
Solution Approach 1:
The patent transitions from static allowlists/blocklists to a dynamic evaluation system using language models that can adapt to new domain name patterns and contexts. The model continuously learns from data to improve its ability to distinguish between malicious and benign domains, providing both high accuracy and flexibility.
Solution Approach 2:
The system changes the evaluation parameters from simple presence/absence in static lists to multiple dimensional features including lexical characteristics, metadata, and contextual analysis. This parameter transformation enables the system to capture nuanced differences between malicious and temporarily compromised benign domains.
2Measurement precision
If language models are used to evaluate domain benignity, then differentiation between malicious and benign domains is improved, but computational resources and complexity increase
Solution Approach 1:
The evaluation pipeline is segmented into distinct modules: language model-based classification, feature extraction from metadata, and heuristic analysis. Each module handles specific aspects of the evaluation, making the complex task manageable and allowing for optimized resource allocation across different components.
Solution Approach 2:
The system uses language models to provide comprehensive analysis but applies heuristics and metadata analysis selectively to reinforce specific evaluation aspects. This partial application of complex analysis where needed while using simpler methods where sufficient reduces overall computational burden.
3Reliability
If comprehensive feature analysis is performed, then evaluation accuracy is enhanced, but processing time increases
Solution Approach 1:
The system performs preliminary feature extraction and pre-computation of domain characteristics before final classification. By preparing and organizing feature data in advance, the language model receives pre-processed information that reduces real-time processing requirements while maintaining comprehensive analysis.
Data Source
AI summary
A root domain evaluation service prompts a language model with task instructions to evaluate various aspects of the root domain that inform a prediction of whether the root domain is benign, where the prompt comprising the task instructions has been engineered so that results of the benignity evaluations provided by the language model can be leveraged to obtain first feature values of the root domain. The service also obtains second feature values of the root domain that comprise data and/or metadata of the root domain. The service inputs the first and second feature values into a classifier trained to predict whether a root domain is benign based on the corresponding features to obtain a prediction of the root domain's benignity. The service also analyzes the second feature values based on heuristics for benign domain name detection to further inform whether the root domain is benign.