DomainDynamics: Lifecycle-Aware Risk Timeline Construction for Domain Names

2024-10-02

Computers & Security

AI Summary

Traditional machine learning relies on static historical data, failing to capture the dynamic evolution of domain purposes and ownership—leading to high false-positive rates in malicious domain detection and delayed risk assessment. To address this, we propose the first domain lifecycle-aware risk modeling framework, systematically covering registration, active, inactive, and re-registration phases to construct fine-grained temporal risk timelines. Our approach innovatively integrates a risk state transition graph with a dynamic confidence fusion mechanism, synergistically combining temporal graph neural networks (TGNNs), survival analysis models, and joint parsing of multi-source WHOIS and DNS logs. Evaluated on large-scale real-world domain traffic data, our framework achieves 92.3% accuracy in predicting malicious domain re-registrations 72 hours in advance, with an 18.6% improvement in F1-score. This significantly enhances the proactivity and dynamic adaptability of domain security governance.

Technology Category

• Application Domains: Security
• Machine Learning: Transfer, Domain Adaptation, Multi-Task Learning
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Vertical and domain-specific search
• Web Mining and Content Analysis: Models for Web evolution

Problem

• Predict domain name risks dynamically
• Improve detection rates of malicious domains
• Reduce false positives in domain detection

Innovation

• Lifecycle-aware domain risk assessment
• Temporal risk timeline construction
• Enhanced detection with low false positives