Beaconing Detection via Dynamic ML Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in detecting malicious beaconing without generating false positives, as malicious beaconing can mimic legitimate network traffic and evade detection through various techniques such as jittering, size variation, and hosting within legitimate cloud providers.
Innovation Solution
An event-based data intake and query system with a late-binding schema is employed, capable of processing and indexing machine data in real-time, allowing for flexible extraction and analysis of events, including regularity, rarity, and outlier analysis to detect beaconing candidates effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current detection technologies are used to identify malicious beaconing, then some malicious connections can be detected, but a large number of false positives are generated
Solution Approach 1:
The system dynamically adjusts detection parameters and thresholds based on learned patterns from training data. The machine learning model adapts to varying beaconing behaviors by continuously learning from new data, allowing it to distinguish between legitimate and malicious traffic more accurately without generating false positives
Solution Approach 2:
The patent transforms detection from static rule-based thresholds to dynamic parameter adjustment through machine learning. The system learns optimal detection parameters from training data including beacon intervals, transmission sizes, and timing patterns, then applies these learned parameters to accurately identify malicious beaconing while avoiding false positives
2Reliability
If detection rules are made more stringent to reduce false positives, then fewer false positives are generated, but detection of actual malicious beaconing decreases
Solution Approach 1:
The system implements feedback loops where detection results are continuously fed back into the training process. The machine learning model learns from both true positives and false positives, adjusting its parameters to improve detection accuracy over time. This feedback mechanism allows the system to maintain low false positive rates while improving malicious beacon detection
3Measurement precision
If traditional beaconing detection methods are used, then some malicious traffic can be identified, but evasion techniques such as jittering and size variation cause detection failures
Solution Approach 1:
The system performs preliminary training actions by learning from extensive training data that includes various evasion techniques. Before actual detection occurs, the machine learning model has already been exposed to and learned patterns of jittering, size variation, and other evasion methods, enabling it to recognize and resist these techniques during deployment
Solution Approach 2:
The detection system dynamically adapts to evasion techniques by learning from training data that incorporates varied beaconing patterns. The model's parameters are dynamically adjusted based on learned patterns rather than relying on static thresholds, making it resistant to jittering and size variation techniques
Data Source
AI summary
A computerized method is disclosed that includes operations of obtaining historical network traffic and preparing a training set of data by: applying security rules to the historical network traffic data to obtain a first filtered subset of network transmissions representing a first set of beaconing candidates that is labeled to form a first set of labeled results, applying a clustering logic to the historical network traffic data to obtain a second filtered subset of network transmissions representing a second set of beaconing candidates that is labeled to form a second set of labeled results, applying a machine learning model to the historical network traffic data to label the historical network traffic forming a third set of labeled results, wherein the first, second and third sets of labeled results are augmented to form an augmented labeled training set, and training a machine learning model using the augmented labeled training set.