Beaconing Detection Algorithm Noise Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing beaconing detection algorithms face high false positive rates and fail to detect multiple interleaved periodicities due to noise and discrete sampling artifacts, leading to incomplete pictures of cyber security threats like APTs.
Innovation Solution
The implementation of statistical hypothesis testing, sampling rate characterization, and Gaussian Mixture Models to filter noise and detect multiple periodicities, automatically determining the optimal number of periodic components without prior knowledge.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing frequency analysis methods are used to detect beaconing behavior, then periodic signals can be identified, but false positive rates increase due to noise and discrete sampling artifacts
Solution Approach 1:
The patent extracts and removes noise components and discrete sampling artifacts from the frequency analysis process. By separating the genuine beaconing signals from noise and artifacts, the method reduces false positives while maintaining detection accuracy of actual periodic behaviors.
Solution Approach 2:
The patent introduces an intermediary statistical hypothesis testing framework that mediates between raw frequency analysis results and final beaconing detection conclusions. This intermediary layer filters out false positives by statistically validating whether detected periodicities are genuine or artifacts before confirming beaconing behavior.
2Measurement precision
If top periodicity detection methods are used, then the most prominent periodic signal is identified, but multiple interleaved periodicities remain undetected
Solution Approach 1:
The patent segments the frequency spectrum into multiple distinct periodicity components rather than detecting only the dominant frequency. By dividing the analysis into separate detection passes or using spectral decomposition techniques, the method identifies multiple interleaved periodicities that characterize complex beaconing behaviors with different intervals.
Solution Approach 2:
The patent transitions from one-dimensional single-frequency detection to multi-dimensional periodicity analysis. By examining the frequency domain across multiple dimensions or layers, the method simultaneously detects multiple periodic signals with different frequencies, capturing the full complexity of beaconing patterns.
Data Source
AI summary
A method for improving a detection of beaconing activity includes receiving input data into a computer-implemented processing procedure at least one listing of at least one of time series data and candidate periods of potential beaconing activity. The input data is processed, to detect candidates of potential beaconing activity. By further evaluating the time series data using techniques used for evaluating an analog signal, the performance of detecting of potential beaconing activity is improved to eliminate false positive indications of beaconing activity and/or to provide indication of multiple interleaved periodicities of beaconing.