Behavior Analysis Engine for Local Network Malicious Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Networked devices are vulnerable to malicious behavior due to insufficiently sophisticated anti-virus software and resource-intensive security measures, which can impact performance and are infeasible for smart appliances with limited computational capabilities.
Innovation Solution
A behavior analysis engine and network traffic hub system that detects malicious executable files and network addresses by executing them in a sandbox environment, applying machine-learned models to determine confidence scores, and condensing models for resource-efficient distribution to network traffic hubs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software is executed on the networked device, then security protection is provided, but device performance is reduced due to resource intensity
Solution Approach 1:
A behavior analysis engine is introduced as an intermediary component that operates separately from the networked device. This engine receives data from the device, performs sophisticated behavior analysis to detect malicious activities, and provides security protection without requiring the device itself to execute resource-intensive anti-virus software. The intermediary handles the computational burden while the device maintains its performance.
2Measurement precision
If sophisticated anti-virus software is used, then detection capability is improved, but resource consumption increases making it infeasible for smart appliances
Solution Approach 1:
The behavior analysis engine serves as a dedicated intermediary that performs sophisticated detection analyses. It collects data from networked devices, executes complex behavior analysis algorithms, and generates security assessments. This separates the high-resource detection function from the resource-constrained devices, allowing smart appliances to benefit from advanced detection without directly consuming the required computational resources.
Solution Approach 2:
The system creates a virtual representation or model of device behavior through the behavior analysis engine. Instead of running full anti-virus software on each device, the engine analyzes copies of device data, execution patterns, and behavior metrics to detect malicious activities. This copying approach enables sophisticated detection on centralized infrastructure rather than on resource-limited devices.
3Reliability
If traditional anti-virus software is deployed, then security coverage is provided, but adaptability to changing threats is insufficient
Solution Approach 1:
The behavior analysis engine implements dynamic adaptability by continuously learning from new data and adjusting its detection models. It employs machine learning algorithms that can be retrained with emerging threat patterns, allowing the system to adapt to changing malicious behaviors. The engine dynamically updates its understanding of normal versus malicious device behavior, providing ongoing security coverage that evolves with new threats.
Solution Approach 2:
The system incorporates feedback mechanisms where detection results, threat intelligence, and behavioral data are continuously fed back into the behavior analysis engine. This feedback loop enables the system to learn from detected threats and improve its detection capabilities over time. The engine adjusts its analysis parameters and models based on feedback from actual security incidents and emerging threat patterns, enhancing adaptability to changing threats.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A behavior analysis engine and a network traffic hub can identify malicious behavior within a local network containing the network traffic hub. The behavior analysis engine can execute executable files that are downloaded by networked devices in the local network in a sandbox environment and determine if the executable files are malicious. The behavior analysis engine can also identify malicious network addresses based on features of the network addresses. The behavior analysis engine may identify entities connected to a received entity and determine whether the entity is malicious based on whether the connected entities are malicious, and further may generate condensed versions of machine-learned models to be executed locally on network traffic hubs in local networks.