Verifying Malicious Domains via VPC Flow Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber threat intelligence data often contains false positives, leading to inaccurate identification of malicious domains or IP addresses, which can result in unnecessary disruptions and reduced effectiveness of cybersecurity protections.
Innovation Solution
The system identifies false positives in malicious domain data using network traffic data logs by analyzing VPC flow log data and comparing it to patterns of known non-malicious traffic, generating confidence scores to determine the likelihood of malicious or non-malicious activity, and implementing response actions such as whitelisting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cyber threat intelligence data is used to identify malicious domains, then cybersecurity protection is enhanced, but false positives increase leading to inaccurate identification
Solution Approach 1:
The patent introduces network traffic data logs as an intermediary to verify threat intelligence data. Instead of directly trusting threat intelligence feeds, the system uses observed network traffic patterns as a mediator to confirm whether a domain is truly malicious, thereby reducing false positives while maintaining security protection
Solution Approach 2:
The system implements feedback by continuously monitoring network traffic and comparing it against threat intelligence data. When discrepancies are detected (such as legitimate traffic to a flagged domain), the system adjusts its classification, creating a closed-loop verification process that reduces false positives over time
2Speed
If threat intelligence data with short lifespan is used, then timely detection is achieved, but data reliability decreases
Solution Approach 1:
The system performs preliminary verification by checking threat intelligence data against existing network traffic logs before taking action. This preliminary check validates whether the short-lived threat data corresponds to actual observed malicious behavior, filtering out unreliable data before it causes false alerts
Solution Approach 2:
The system dynamically adjusts its trust level in threat intelligence data based on verification results. When threat data aligns with observed traffic patterns, confidence increases; when discrepancies occur, the system reduces reliance on that data source, creating a dynamic reliability assessment that adapts to data quality
3Measurement precision
If comprehensive threat intelligence data is analyzed, then detection accuracy improves, but alert fatigue increases
Solution Approach 1:
The system applies partial verification by selectively validating threat intelligence data only when necessary - specifically when threat data conflicts with observed network traffic patterns. This partial action approach maintains high detection accuracy for suspicious cases while avoiding unnecessary verification overhead for clearly malicious traffic, thus reducing alert fatigue
Data Source
AI summary
Systems, methods, and computer-readable media are disclosed for systems and methods for identifying false positives in malicious domain data using network traffic data logs. Example methods may include determining a first domain name identifier in a set of domain name identifiers classified as malicious, determining a first IP address associated with the first domain name identifier, and determining first virtual private cloud (VPC) flow log data that corresponds to historical network traffic associated with the first IP address. Certain methods may include determining second VPC flow log data that corresponds to historical network traffic associated with a second IP address that is classified as non-malicious, determining, using the first VPC flow log data and the second VPC flow log data, that the first VPC flow log data is non-malicious, and determining that the first domain name identifier is to be classified as non-malicious.