Wide And Deep Learning for DGA Domain Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional solutions for detecting malicious domain names generated by domain generation algorithms (DGAs) are outdated, lack flexibility, and produce numerous false positives due to the dynamic nature and advanced patterns used in creating these domain names, making it difficult to distinguish between legitimate and malicious communications.
Innovation Solution
A comprehensive DGA detection system utilizing deep and wide machine learning architectures, incorporating feature engineering and multiple layers such as LSTM and wide inputs, to learn and adapt to the nuances and patterns of DGA-generated domains, reducing false positives and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static matching or static lists are used to detect malicious domain names, then the detection method is simple and fast, but the solutions quickly become outdated and unreliable as DGA dictionaries grow dynamically
Solution Approach 1:
The patent transitions from static detection lists to dynamic machine learning models that continuously adapt to new DGA patterns. The system uses trained neural networks that can identify malicious domains based on learned characteristics rather than predefined lists, enabling the detection mechanism to evolve alongside emerging threats while maintaining operational speed.
Solution Approach 2:
The patent changes the fundamental parameters of detection by moving from exact string matching to probabilistic pattern recognition. Machine learning models analyze multiple features of domain names simultaneously (character frequencies, n-grams, entropy metrics) and produce risk scores, transforming the detection approach from binary static matching to nuanced dynamic evaluation that improves both accuracy and adaptability.
2Device complexity
If conventional detection methods are used, then the system is simple to implement, but it produces numerous false positives and lacks flexibility in detecting varying DGA patterns
Solution Approach 1:
The patent segments the detection problem into multiple independent feature extraction components (character frequency analysis, n-gram matching, entropy calculation, lexical pattern recognition). Each component processes specific aspects of domain names separately, then their results are combined by the machine learning model. This segmentation enables precise detection of diverse DGA patterns while keeping individual components manageable and interpretable.
Solution Approach 2:
The patent creates a composite detection system that combines multiple detection techniques and feature types into a unified machine learning framework. Rather than relying on a single detection method, the system integrates various analytical approaches (statistical analysis, pattern matching, entropy measurement) into a composite model that leverages the strengths of each component while mitigating their individual weaknesses, thereby reducing false positives and improving overall precision.
3Ease of manufacture
If static lists of malicious domains are maintained, then the detection approach is straightforward, but it fails to keep up with quickly growing dictionaries of malicious domain names
Solution Approach 1:
The patent implements a self-updating detection system where machine learning models are continuously trained on new data and automatically adapt to emerging DGA patterns. The system performs self-learning and self-improvement by processing new domain name data and updating its internal representations without requiring manual intervention to update static lists, thereby maintaining ease of deployment while achieving high adaptability to evolving threats.
Solution Approach 2:
The patent applies preliminary training actions to the machine learning models using extensive datasets of both legitimate and malicious domain names before deployment. This pre-training establishes a strong baseline detection capability that can immediately handle known threats, while the models retain the flexibility to adapt to new patterns. The preliminary action of training creates a robust foundation that simplifies ongoing operation while ensuring adaptability.
Data Source
AI summary
A computer-implemented method for detecting malicious content is disclosed that includes operations of receiving a character set as an input, where the character set represents a domain name, generating a deep machine learning output by analyzing the character set with a first plurality of layers arranged in a deep machine learning architecture, generating a wide machine learning output by analyzing the character set with a second plurality of layers arranged in a wide machine learning architecture, and jointly processing the deep machine learning output and the wide machine learning output resulting in a comparison score that is indicative of a probability that the character set was generated by a domain generation algorithm (DGA).