Anomaly Detection Model for Malicious Traffic with Low False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malicious network traffic, particularly unstructured payloads, is challenging due to their lack of structure, making it difficult to recognize legitimate traffic and detect unknown or zero-day attacks, with existing methods struggling to achieve low false positives.
Innovation Solution
An anomaly detection model trained on malicious traffic features classifies unstructured payloads by extracting human-readable ASCII strings, correlating them with known malicious features, and generating sparse feature vectors to identify malicious traffic with low false positives through a combination of feature extraction and classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If anomaly detection models are trained on normal traffic data to identify deviations, then unknown attacks can be detected, but false positives increase due to unstructured payload variability
Solution Approach 1:
The patent inverts the traditional anomaly detection approach by training the model on malicious traffic data to identify normal patterns, rather than training on normal data to detect deviations. This is achieved through the loss function that penalizes misclassification of malicious samples as normal, allowing the system to maintain low false positives while detecting unknown attacks
2Difficulty of detecting and measuring
If feature extraction is performed on unstructured payloads to enable detection, then malicious traffic can be identified, but detection accuracy decreases for zero-day attacks lacking known patterns
Solution Approach 1:
The patent transforms unstructured payload data into structured feature vectors by extracting specific parameters such as ASCII string frequencies, payload length, and protocol characteristics. This parameter transformation enables the anomaly detection model to process and analyze unstructured data effectively, improving both detectability and precision
Data Source
AI summary
An anomaly detection model is trained to detect malicious traffic sessions with a low rate of false positives. A sample feature extractor extracts tokens corresponding to human-readable substrings of incoming unstructured payloads in a traffic session. The tokens are correlated with a list of malicious traffic features and frequent malicious traffic features across the traffic session are aggregated into a feature vector of malicious traffic feature frequencies. An anomaly detection model trained on feature vectors for unstructured malicious traffic samples predicts the traffic session as malicious or unclassified. The anomaly detection model is trained and updated based on its' ongoing false positive rate and malicious traffic features in the list of malicious traffic features that result in a high false positive rate are removed.