Beaconing Detection via Machine Learning Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in detecting malicious beaconing without generating false positives, as malicious beaconing can mimic legitimate network traffic and evade detection through various techniques such as jittering, size variations, and hosting within legitimate cloud providers.
Innovation Solution
An event-based data intake and query system with a late-binding schema is employed to process and index machine data, enabling flexible extraction rules and field-searchable data storage, which aids in identifying regularity, rarity, and outlier analyses to detect beaconing candidates within network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional beaconing detection methods are used, then detection capability is provided, but false positives increase significantly
Solution Approach 1:
The system changes detection parameters by analyzing multiple dimensions of network traffic data simultaneously (timing intervals, packet sizes, destination ports, protocols) rather than relying on single-parameter thresholds. This multi-dimensional parameter analysis enables more accurate distinction between legitimate and malicious beaconing patterns, reducing false positives while maintaining detection capability.
Solution Approach 2:
The patent introduces an intermediary analysis layer that processes network traffic data through multiple filtering and analysis stages before final detection. This intermediary processing layer includes correlation analysis, temporal pattern recognition, and context-aware evaluation that mediates between raw traffic data and detection decisions, thereby reducing false positives.
2Adaptability or versatility
If detection sensitivity is increased to catch all beaconing patterns, then detection coverage improves, but false positives increase
Solution Approach 1:
The system dynamically adjusts detection sensitivity and analysis depth based on contextual information and learned patterns. The detection algorithm adapts its stringency based on the analyzed entity's behavior history, network context, and identified patterns, allowing high detection coverage for known beaconing while maintaining reliability through adaptive filtering of false positives.
Solution Approach 2:
The patent implements feedback mechanisms where detection results and analyzed patterns are fed back into the system to refine future detections. This feedback loop allows the system to learn from previous analyses, adjust detection parameters, and improve discrimination between legitimate and malicious patterns, thereby reducing false positives while maintaining broad detection coverage.
3Speed
If machine data is processed in real-time, then detection speed improves, but system complexity increases
Solution Approach 1:
The system segments the data processing workload into distinct modular components: data collection modules, analysis modules (timing, size, protocol), correlation modules, and detection modules. This segmentation enables real-time processing by allowing each component to operate independently and process data streams concurrently, improving detection speed while managing complexity through modular architecture.
Solution Approach 2:
The patent applies preliminary action by pre-defining detection criteria, analysis frameworks, and processing pipelines before actual detection occurs. The system pre-processes data structures, pre-establishes analysis parameters, and pre-configures detection algorithms, which reduces real-time processing complexity and enables faster detection by avoiding on-the-fly decision-making for basic analysis tasks.
Data Source
AI summary
A computerized method is disclosed that includes operations of obtaining network traffic data between a source device and a destination device, applying a set of one or more security rules to a plurality of metrics of the network traffic data to obtain a subset of network traffic metrics, applying a first trained machine learning model to the subset of network traffic metrics to generate a feature vector through feature extraction of the subset of network traffic metrics, and evaluate the feature vector for a presence of beaconing and classify the subset of network traffic metrics, and responsive to the classifying of the subset of network traffic metrics, generating a flag for a system administrator. The plurality of metrics include at least one or more of packet size, packet transmission rate, or a ratio of (i) packet size for inbound packets and (ii) packet size for outbound packets.