Proactively detecting malicious domains using graph representation learning
Proactively detecting malicious domains using graph representation learning may be provided by extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains; expanding the seed domains to a via a passive domain name service (PDNS) crawl to include additional domains with the seed domains; collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious; constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains are represented as a node in the GNN that includes feature values associated that domain; training the GNN to classify unseen domains not associated with a node as either benign or malicious; and classifying, via the GNN, a queried domain as either benign or malicious.
1 . A method, comprising:
extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains;
expanding the seed domains via a passive domain name service crawl to include additional domains with the seed domains;
collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious;
constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains is represented as a node in the GNN that includes feature values associated with that domain;
training the GNN to classify unseen domains not associated with a node as either benign or malicious; and
classifying, via the GNN, a queried domain as either benign or malicious.
2 . The method of claim 1 , wherein constructing the GNN includes:
assembling an ensemble of GNN encoders in a model stack; and
combining outputs of the ensemble of GNN encoders via a metalearner.
3 . The method of claim 1 , wherein labeling the first set of the seed domains as benign includes:
selecting the first set from the URL feed as domains that have not been seen before;
excluding domains that resolve to sinkhole Internet Protocol addresses;
excluding domains that do not have a valid certificate;
excluding domains that have URLs identified as being created via a domain generation algorithm;
excluding domains identified as impersonating a brand name;
excluding domains associated with a top level domain associated with hosting malicious domains by a third party analysis;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed above a consensus threshold;
excluding domains that have been registered from less time than a registration threshold;
adding domains having .gov and .edu TLDs; and
adding domains belonging to a popularity feed.
4 . The method of claim 1 , wherein labeling the second set of the seed domains as malicious includes:
selecting the second set from the URL feed as domains that have not been seen before;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed below a consensus threshold;
excluding domains that have been registered from more time than a registration threshold; and
adding the seed domains.
5 . The method of claim 1 , wherein classifying the queried domain creates a blocklist of several domains classified as malicious from the URL feed and one or more domains not seen in the URL feed that are proactively identified as malicious based on a relationship with domains identified as malicious by the GNN.
6 . The method of claim 1 , wherein classifying the queried domain returns a real-time response that identifies the queried domain as either benign or malicious.
7 . The method of claim 1 , wherein the queried domain is classified as benign or malicious at hosting infrastructure upstream of content delivery without analyzing content hosted by the queried domain.
8 . A system, comprising a processor and a memory including instructions that when executed by the processor, perform operations including:
extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains;
expanding the seed domains via a passive domain name service crawl to include additional domains with the seed domains;
collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious;
constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains is represented as a node in the GNN that includes feature values associated with that domain;
training the GNN to classify unseen domains not associated with a node as either benign or malicious; and
classifying, via the GNN, a queried domain as either benign or malicious.
9 . The system of claim 8 , wherein constructing the GNN includes:
assembling an ensemble of GNN encoders in a model stack; and
combining outputs of the ensemble of GNN encoders via a metalearner.
10 . The system of claim 8 , wherein labeling the first set of the seed domains as benign includes:
selecting the first set from the URL feed as domains that have not been seen before;
excluding domains that resolve to sinkhole Internet Protocol addresses;
excluding domains that do not have a valid certificate;
excluding domains that have URLs identified as being created via a domain generation algorithm;
excluding domains identified as impersonating a brand name;
excluding domains associated with a top level domain associated with hosting malicious domains by a third party analysis;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed above a consensus threshold;
excluding domains that have been registered from less time than a registration threshold;
adding domains having .gov and .edu TLDs; and
adding domains belonging to a popularity feed.
11 . The system of claim 8 , wherein labeling the second set of the seed domains as malicious includes:
selecting the second set from the URL feed as domains that have not been seen before;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed below a consensus threshold;
excluding domains that have been registered from more time than a registration threshold; and
adding the seed domains.
12 . The system of claim 8 , wherein classifying the queried domain creates a blocklist of several domains classified as malicious from the URL feed and one or more domains not seen in the URL feed that are proactively identified as malicious based on a relationship with domains identified as malicious by the GNN.
13 . The system of claim 8 , wherein classifying the queried domain returns a real-time response that identifies the queried domain as either benign or malicious.
14 . The system of claim 8 , wherein the queried domain is classified as benign or malicious at hosting infrastructure upstream of content delivery without analyzing content hosted by the queried domain.
15 . A memory including instructions, that when executed by a processor, perform operations including:
extracting seed domains from a uniform resource locator (URL) feed of observed requests for access to domains;
expanding the seed domains via a passive domain name service crawl to include additional domains with the seed domains;
collecting a ground truth, including labeling a first set of the seed domains as benign and a second set of the seed domains as malicious;
constructing a graph neural network (GNN) of the additional domains and the seed domains, wherein each domain of the additional domains and the seed domains is represented as a node in the GNN that includes feature values associated with that domain;
training the GNN to classify unseen domains not associated with a node as either benign or malicious; and
classifying, via the GNN, a queried domain as either benign or malicious.
16 . The memory of claim 15 , wherein constructing the GNN includes:
assembling an ensemble of GNN encoders in a model stack; and
combining outputs of the ensemble of GNN encoders via a metalearner.
17 . The memory of claim 15 , wherein labeling the first set of the seed domains as benign includes:
selecting the first set from the URL feed as domains that have not been seen before;
excluding domains that resolve to sinkhole Internet Protocol addresses;
excluding domains that do not have a valid certificate;
excluding domains that have URLs identified as being created via a domain generation algorithm;
excluding domains identified as impersonating a brand name;
excluding domains associated with a top level domain associated with hosting malicious domains by a third party analysis;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed above a consensus threshold;
excluding domains that have been registered from less time than a registration threshold;
adding domains having .gov and .edu TLDs; and
adding domains belonging to a popularity feed.
18 . The memory of claim 15 , wherein labeling the second set of the seed domains as malicious includes:
selecting the second set from the URL feed as domains that have not been seen before;
excluding domains that have a consensus score assigned by a plurality of consensus sensors in a consensus feed below a consensus threshold;
excluding domains that have been registered from more time than a registration threshold; and
adding the seed domains.
19 . The memory of claim 15 , wherein classifying the queried domain creates a blocklist of several domains classified as malicious from the URL feed and one or more domains not seen in the URL feed that are proactively identified as malicious based on a relationship with domains identified as malicious by the GNN.
20 . The memory of claim 15 , wherein classifying the queried domain returns a real-time response that identifies the queried domain as either benign or malicious.