Stockpiled Domain Detection Using Fingerprints, Heuristics, and ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybercriminals are increasingly using sophisticated techniques to obfuscate malicious domains, making it difficult for security platforms to detect and prevent the deployment of malicious stockpiled domains, which can compromise computer systems and form botnets.
Innovation Solution
A system and method using fingerprinting, heuristics-based, and machine learning classifications to identify malicious stockpiled domains by analyzing domain data from sources like certificate logs, passive DNS datasets, and WHOIS datasets, employing a machine learning model trained on benign and malicious domains to predict domain classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional domain detection methods are used, then the system is simpler to implement, but the detection accuracy deteriorates due to sophisticated obfuscation techniques
Solution Approach 1:
The detection system is divided into multiple independent classification modules: fingerprinting-based classification, heuristics-based classification, and machine learning-based classification. Each module analyzes different aspects of domain data (certificates, DNS records, WHOIS information) and contributes to the overall detection accuracy without requiring the entire system to be complex
Solution Approach 2:
The patent combines multiple detection approaches (fingerprinting, heuristics, machine learning) into a unified classification system. The results from different classification methods are integrated to produce a comprehensive domain assessment, achieving higher accuracy than any single method could provide alone
2Measurement precision
If multiple classification methods are applied to improve detection accuracy, then the detection capability improves, but the processing time increases
Solution Approach 1:
The system applies classification methods selectively based on the domain's characteristics and the available computational resources. Not all classification methods are applied to every domain equally - the system can adjust the depth and breadth of analysis based on risk assessment and processing constraints
Solution Approach 2:
The fingerprinting-based classification and heuristics-based classification perform preliminary analysis that can quickly identify obvious malicious domains without requiring time-consuming machine learning analysis. This preliminary screening reduces the overall processing time by filtering out easy cases before applying more resource-intensive methods
3Measurement precision
If domain data from multiple sources is collected and analyzed, then the detection accuracy improves, but the data processing complexity increases
Solution Approach 1:
The data processing is segmented into distinct stages: collecting domain data from multiple sources (certificates, DNS, WHOIS), processing each data type through specialized handlers, and then feeding the processed information to the classification algorithms. This segmentation makes the complex data processing manageable and maintainable
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting stockpiled domains. The method includes (i) determining that a candidate domain is a malicious stockpiled domain using one or more of (a) a fingerprinting classification, (b) a heuristics-based classification, and (c) a machine learning classification, and (ii) applying a security policy based on a classification of the candidate domain as the malicious stockpiled domain.