Malicious Beacon Detection via Graph Path Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting periodic transmissions indicative of malicious network communications, such as malware beaconing signals, suffer from high false positives and are ineffective in noisy environments, failing to identify true periodic events with erratic latencies.
Innovation Solution
A network security device monitors communications, estimates periodicity, constructs a graph with time points and intervals, and finds the longest path to verify periodicity, using a threshold length to increase confidence in identifying malicious communications, even in the presence of noise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a signal processing algorithm is used to estimate periodicity of transmissions, then true positives are increased, but false positives also increase
Solution Approach 1:
The verification process is segmented into multiple independent checks: (1) determining candidate time point pairs with matching intervals, (2) constructing a graph structure with time points as nodes and intervals as edges, (3) finding the longest continuous path in the graph, and (4) comparing the path length to a threshold. This segmentation allows the system to maintain high true positive detection while filtering out false positives through cumulative verification steps.
2Reliability
If a statistics-based verification algorithm is used to verify periodic transmissions, then some false positives are filtered, but true periodic events with erratic latencies are not effectively identified
Solution Approach 1:
The invention transforms the verification problem from a one-dimensional statistical test into a two-dimensional graph traversal problem. By constructing a graph where nodes represent time points and edges represent time intervals, the system can visualize and quantify the continuity of periodic patterns. The longest path algorithm then operates in this graphical dimension to verify periodicity, effectively handling erratic latencies that would fail simple statistical tests.
Solution Approach 2:
Before performing the final verification, the system pre-identifies candidate time point pairs whose intervals match the estimated periodicity. This preliminary filtering step reduces the search space and prepares the data structure (graph) in advance, enabling efficient verification of periodic patterns even when latencies vary erratically due to noise.
Data Source
AI summary
In one embodiment, a network security device monitors network communications between a computer and another computer. A periodicity of transmissions made by one computer to the other computer is determined, with the periodicity being used to identify candidate time point pairs having intervals that match the periodicity. A graph is constructed with time points of the candidate time point pairs as nodes and with intervals of time point pairs as edges. A longest path that continuously links one time point to another time point on the graph is compared to a threshold length to verify that the transmissions are periodic, and are thus potentially indicative of malicious network communications.