Bait Address Malware Detection via Inversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting stealth worms, such as signature-based and traffic anomaly analysis, are ineffective due to low signal-to-noise ratios and the ability of malware to adjust its signal signatures, leading to high false positives and difficulty in identifying compromised hosts.
Innovation Solution
A network switch allocates a bait address and sends bait packets to entice malware into sending scan packets, allowing for the reliable identification of infected hosts by receiving unexpected incoming packets, thereby improving stealth worm detection without relying on signature analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traffic anomaly analysis is used to detect stealth worms, then detection capability is improved, but false positive rate increases due to low signal-to-noise ratio
Solution Approach 1:
The system performs preliminary actions by sending bait packets to potential targets before actual worm propagation occurs. This allows the detection system to identify compromised hosts in advance by observing their responses to bait packets, thereby improving detection capability while reducing false positives through controlled preliminary probing rather than reactive anomaly analysis
Solution Approach 2:
Bait packets serve as an intermediary mechanism between the detection system and potential worm-infected hosts. Instead of directly analyzing traffic anomalies from stealth worms, the system uses bait packets as mediators to elicit responses from compromised hosts, thereby improving detection reliability by creating a controlled interaction scenario that reduces false positives
2Speed
If signature-based methods are used to identify malware, then detection speed is improved, but detection accuracy deteriorates as worms change signatures
Solution Approach 1:
Instead of analyzing outgoing traffic from worms to identify them, the system inverts the approach by sending bait packets to hosts and analyzing their responses. This inversion allows detection of infected hosts through their automated responses to bait packets, maintaining high detection speed while achieving high accuracy even against worms with changing signatures, since the detection is based on behavioral response patterns rather than signature matching
3Object-affected harmful factors
If stealth worms send scan packets at low rates, then their stealth capability is improved, but detection difficulty increases
Solution Approach 1:
The system performs preliminary scanning by sending bait packets to all potential hosts before worms can propagate. This preliminary action reveals infected hosts through their automated responses to bait packets, thereby maintaining the worms' stealth capability (low scan rates) while significantly reducing detection difficulty through proactive identification of compromised hosts
Solution Approach 2:
The system converts the harmful automated response behavior of worm-infected hosts into a beneficial detection mechanism. By sending bait packets, the system causes infected hosts to automatically respond in ways that reveal their compromised state, thereby transforming the worms' harmful automation into a useful signal for detection without requiring increased scan rates
Data Source
AI summary
Methods and systems are presented for detection of malware such as worms in which a network switch entices the malware into sending scan packets by allocating one or more ports as bait addresses, sending outgoing bait packets, and identifying compromised hosts that send unexpected incoming packets to a bait address.