Behavioral Model for Network Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity measures, including signature-based host security and network-based security, face challenges in detecting zero-day attacks and polymorphic/metamorphic malware due to reliance on prior knowledge of malicious code and behaviors, leading to high false positive/negative rates and inability to capture evolving threats.
Innovation Solution
A comprehensive end-to-end data security system that blends host-based and network-based security by generating statistical models from threat signatures to identify behavioral patterns, allowing for real-time detection of malicious activities and reducing false positives/negatives through behavioral modeling and payload analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based host security is used to detect malicious code, then detection rate for known threats is improved, but false positive/negative rates increase and zero-day attacks cannot be detected
Solution Approach 1:
The system performs preliminary actions by collecting ground truth data from host-based security tools and network-based tools before building the behavioral model. This pre-collection and labeling of data enables the system to establish baseline behaviors and threat patterns in advance, allowing it to detect both known and unknown threats effectively without relying solely on signature matching at the time of detection.
Solution Approach 2:
The patent introduces an intermediary behavioral model that bridges host-based security and network-based security approaches. This model integrates data from both sources and uses machine learning to create a unified detection mechanism that reduces false positives while maintaining high detection rates, effectively mediating between the two security paradigms.
2Adaptability or versatility
If network behavior anomaly detection systems are used to discover threats without prior knowledge, then zero-day attacks can be detected, but false positive/negative rates increase
Solution Approach 1:
The system merges network-based anomaly detection with host-based security data by integrating ground truth from both sources. This combination allows the behavioral model to learn from labeled examples what normal and malicious behaviors look like, thereby reducing false positives while maintaining the ability to detect unknown threats that pure anomaly detection would generate as false alarms.
Solution Approach 2:
The system implements feedback mechanisms where ground truth labels from security tools are used to train and refine the behavioral model continuously. This feedback loop allows the system to learn from its mistakes, adjust its detection thresholds, and improve precision over time by incorporating real outcomes from security operations.
3Adaptability or versatility
If statistical models are trained without solid ground truth, then threat discovery capability is improved, but model precision decreases
Solution Approach 1:
The system performs preliminary data collection and labeling using ground truth from security tools before training the statistical model. This pre-preparation of labeled training data ensures that the model learns from accurate examples of both benign and malicious behaviors, thereby achieving high precision while maintaining strong threat discovery capability.
Data Source
AI summary
A method for profiling network traffic of a network. The method includes obtaining a signature library comprising a plurality of signatures corresponding to a plurality of behavioral models, generating, based on a first pre-determined criterion, a group behavioral model associated with the signature library, wherein the group behavioral model represents a common behavior of a plurality of historical flows identified from the network traffic, wherein each of the plurality of signatures correlates to a subset of the plurality of historical flows, selecting a flow in the network traffic for including in a target flow set, wherein the flow matches the group behavioral model without matching any of the plurality of behavioral models, analyzing the target flow set to generate a new signature, and adding the new signature to the signature library. Further, each behavioral model is generated from a kernel constructed using boosting of decision tree learning methods.