Detecting random and/or algorithmically-generated character sequences in domain names
Aspects of the disclosure relate to detecting random and/or algorithmically-generated character sequences in domain names. A computing platform may train a machine learning model based on a set of semantically-meaningful words. Subsequently, the computing platform may receive a seed string and a set of domains to be analyzed in connection with the seed string. Based on the machine learning model, the computing platform may apply a classification algorithm to the seed string and the set of domains, where applying the classification algorithm to the seed string and the set of domains produces a classification result. Thereafter, the computing platform may store the classification result.
1 . A computing platform, comprising:
at least one processor;
a communication interface; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
train a machine learning model based on a set of semantically-meaningful words, wherein training the machine learning model includes:
accessing a dictionary of words;
based on accessing the dictionary of words, generating a plurality of counterpart samples for training purposes;
receive a seed string and a set of domains to be analyzed in connection with the seed string;
based on the machine learning model, apply a classification algorithm to the seed string and the set of domains, wherein applying the classification algorithm to the seed string and the set of domains produces a classification result and includes:
calculating similarity scores for domain segments in the set of domains in view of seed segments in the seed string;
preliminarily classifying each domain segment based on its corresponding similarity score;
inputting domain segments preliminarily classified as random into the machine learning model to obtain a prediction score; and
determining, based on a weighted summation of the similarity score and the prediction score, whether a given domain is classified as random or not-random; and
store the classification result.
2 . The computing platform of claim 1 , wherein the set of semantically meaningful words is selected from the dictionary of words.
3 . The computing platform of claim 1 , wherein training the machine learning model further comprises training a bagging classifier associated with ensemble meta-algorithms.
4 . The computing platform of claim 1 , wherein receiving the seed string and the set of domains to be analyzed in connection with the seed string comprises receiving the seed string and the set of domains to be analyzed from a cybersecurity server or one or more user devices.
5 . The computing platform of claim 1 , wherein receiving the seed string and the set of domains to be analyzed in connection with the seed string comprises receiving a set of seed-domain string pairs to investigate.
6 . The computing platform of claim 5 , wherein receiving the seed string and the set of domains to be analyzed in connection with the seed string comprises preparing a feature vector for each string pair in the set of seed-domain string pairs.
7 . The computing platform of claim 1 , wherein determining whether a given domain is classified as random or not-random further includes:
calculating a weighted average based on the weighted summation, wherein the weighted average is a numerical value between 0 and 1 and indicative of whether a given domain is classified as random, indeterminate, or not-random.
8 . The computing platform of claim 1 , wherein storing the classification result comprises identifying a first domain as being classified as indeterminate and adding the first domain to set of domains requiring further investigation.
9 . The computing platform of claim 1 , wherein storing the classification result comprises identifying a second domain as being classified as not-random and generating an alert to an entity associated with the second domain.
10 . The computing platform of claim 1 , wherein storing the classification result comprises updating tuning data that causes the computing platform to improve modeling results associated with the machine learning model.
11 . The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, via the communication interface, to a cybersecurity server, the classification result, wherein sending the classification result to the cybersecurity server causes the cybersecurity server to update one or more security algorithms.
12 . The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
send, via the communication interface, to a user device, the classification result, wherein sending the classification result to the user device causes the user device to present an analysis user interface.
13 . The computing platform of claim 1 , wherein each counterpart sample is a scrambled version of a word from the dictionary of words.
14 . A method, comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
training, by the at least one processor, a machine learning model based on a set of semantically-meaningful words, wherein training the machine learning model includes:
accessing a dictionary of words;
based on accessing the dictionary of words, generating a plurality of counterpart samples for training purposes;
receiving, by the at least one processor, a seed string and a set of domains to be analyzed in connection with the seed string;
based on the machine learning model, applying, by the at least one processor, a classification algorithm to the seed string and the set of domains, wherein applying the classification algorithm to the seed string and the set of domains produces a classification result and includes:
calculating similarity scores for domain segments in the set of domains in view of seed segments in the seed string;
preliminarily classifying each domain segment based on its corresponding similarity score;
inputting domain segments preliminarily classified as random into the machine learning model to obtain a prediction score; and
determining, based on a weighted summation of the similarity score and the prediction score, whether a given domain is classified as random or not-random; and
storing, by the at least one processor, the classification result.
15 . The method of claim 14 , wherein the set of semantically meaningful words is selected from the dictionary of words.
16 . The method of claim 14 , wherein training the machine learning model comprises training a bagging classifier associated with ensemble meta-algorithms.
17 . The method of claim 14 , wherein receiving the seed string and the set of domains to be analyzed in connection with the seed string comprises receiving the seed string and the set of domains to be analyzed from a cybersecurity server or one or more user devices.
18 . The method of claim 14 , wherein receiving the seed string and the set of domains to be analyzed in connection with the seed string comprises receiving a set of seed-domain string pairs to investigate.
19 . The method of claim 14 , wherein each counterpart sample is a scrambled version of a word from the dictionary of words.
20 . One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
train a machine learning model based on a set of semantically-meaningful words, wherein training the machine learning model includes:
accessing a dictionary of words;
based on accessing the dictionary of words, generating a plurality of counterpart samples for training purposes,;
receive a seed string and a set of domains to be analyzed in connection with the seed string;
based on the machine learning model, apply a classification algorithm to the seed string and the set of domains, wherein applying the classification algorithm to the seed string and the set of domains produces a classification result and includes:
calculating similarity scores for domain segments in the set of domains in view of seed segments in the seed string;
preliminarily classifying each domain segment based on its corresponding similarity score;
inputting domain segments preliminarily classified as random into the machine learning model to obtain a prediction score; and
determining, based on a weighted summation of the similarity score and the prediction score, whether a given domain is classified as random or not-random; and
store the classification result.