Weighted Domain Graph for Maliciousness Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious domains are inadequate in identifying subtle relationships between known and unknown domains in real-time, often leading to delayed detection and false positives due to their reliance on local DNS features and simplistic IP address associations, which can be easily manipulated by malicious actors.
Innovation Solution
A system that uses weighted domain graphs to assess maliciousness by classifying domains and IP addresses based on attributes and associations, employing machine learning models and algorithms like belief propagation to infer maliciousness from richer associations between dedicated and public hosting environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If local DNS features and webpage content analysis are used to identify malicious domains, then detection simplicity is improved, but detection accuracy and timeliness deteriorate due to inability to capture subtle relationships between domains
Solution Approach 1:
The patent transitions from analyzing single-domain local features to constructing a multi-dimensional domain relationship graph that captures connections between domains, IP addresses, and hosting providers. This graph-based approach adds relational dimensions to the analysis, enabling detection of subtle malicious patterns that local features alone cannot reveal.
Solution Approach 2:
The patent combines multiple data sources including DNS features, IP address information, hosting provider data, and domain relationship networks into a unified analysis framework. By merging these diverse information sources into a comprehensive graph model, the system achieves higher detection accuracy while maintaining operational simplicity through automated graph inference.
2Speed
If basic DNS searching methods are used, then detection speed is improved, but false positive rate increases due to inability to distinguish malicious from benign domains sharing infrastructure
Solution Approach 1:
The patent applies different analysis weights to different relationships in the domain graph. Instead of treating all IP address associations equally, the system evaluates the quality and context of each relationship, considering factors such as hosting provider reputation, domain age, and connection patterns. This localized quality assessment reduces false positives while maintaining fast detection through graph-based inference.
3Measurement precision
If domain relationship analysis via weighted graphs is implemented, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent implements automated graph construction and inference algorithms that self-organize domain relationships without manual intervention. The system automatically builds the weighted domain graph from DNS and hosting data, computes relationship weights, and performs maliciousness inference through graph algorithms. This self-service approach manages system complexity through automation while achieving high detection accuracy.
Solution Approach 2:
The patent pre-computes and stores domain relationship graphs and their weights for efficient querying. By preparing the graph structure and relationship metrics in advance, the system enables rapid maliciousness assessment when new domains need evaluation, balancing the complexity of graph construction with the speed of subsequent detection operations.
4Loss of time
If real-time graph inference is performed, then detection timeliness is improved, but computational resource consumption increases
Solution Approach 1:
The patent performs graph inference selectively rather than continuously analyzing all domains. The system focuses computational resources on domains that show suspicious characteristics or have connections to known malicious domains in the graph. This partial action approach reduces overall computational resource consumption while maintaining real-time detection capability for high-risk domains.
Data Source
AI summary
The presently disclosed method and system exploits information and traces contained in DNS data to determine the maliciousness of a domain based on the relationship it has with other domains. A method may comprise providing data to a machine learning module that was previously trained on domain and IP address attributes or classifiers. The method then may comprise classifying apex domains and IP addresses based on the IP address and domain attributes or classifiers. Additionally, the method may comprise associated each of the domains and IP addresses based on the corresponding classification. The method may further comprise building a weighted domain graph at real-time utilizing the DNS data based on the aforementioned associations among domains. The method may then comprise assessing the maliciousness of a domain based on the weighted domain graph that was built.