Patent ID: 11956261
Assignee: ACER CYBER SECURITY INCORPORATED
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 8:
9. A detection device, for detecting a malicious domain name in a DNS, the detection device comprising:
a web interface, for obtaining network connection data of an electronic device; and
a processor, coupled to the web interface, wherein
the processor is configured to capture log data related to at least one domain name from the network connection data,
the processor is further configured to analyze the log data to generate at least one numerical feature related to the at least one domain name, wherein the at least one numerical feature comprises at least one domain name evaluation value, and the at least one domain name evaluation value reflects a statistical characteristic of a character composition in the at least one domain name, wherein the at least one domain name comprises a first domain name, the statistical characteristic comprises a ratio of a first character string in the first domain name, a ratio of a second character string in all of the at least one domain name, a length of a third character string in the first domain name and a total length of fourth character strings in the first domain name,
the processor is further configured to input the at least one numerical feature into a multi-type prediction model, comprising a first data model and a second data model, wherein the first data model is built based on a first malicious feature related to a malware, and the second data model is built based on a second malicious feature related to a phishing website, and
the processor is further configured to run the multi-type prediction model to predict whether a malicious domain name related to the malware or the phishing website exists in the at least one domain name according to the at least one numerical feature.