Security Attack Detection Using Benford's Law Distribution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in detecting advanced persistent threats (APT) and low-and-slow attacks on computing system security, as these attacks are difficult to detect due to their surreptitious nature and reliance on normal traffic patterns, often requiring computationally intensive methods that are costly and resource-intensive.
Innovation Solution
The implementation of a security attack detection system that electronically extracts digital item occurrence data, compares it to a model distribution based on Benford's Phenomenon, and raises an alert when deviations exceed a predefined threshold, allowing for efficient detection of security attacks without relying on malware code signatures or baseline normal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If computationally intensive detection methods are used to detect APT and low-and-slow attacks, then detection capability is improved, but computational cost and resource consumption increase
Solution Approach 1:
The patent segments the detection process into multiple stages: first applying lightweight distribution analysis to identify potential attacks, then using more intensive methods only when needed. This hierarchical segmentation allows the system to maintain high detection capability while minimizing overall computational cost by avoiding unnecessary intensive analysis of normal traffic patterns.
Solution Approach 2:
The patent changes the detection parameter from analyzing complete traffic patterns to analyzing distribution characteristics (such as frequency distributions of network events). This parameter transformation reduces computational complexity while maintaining detection effectiveness, as distribution analysis requires significantly fewer computational resources than full pattern matching.
2Measurement precision
If traditional detection methods relying on baseline normal behavior are used, then detection accuracy is improved, but system complexity and resource requirements increase
Solution Approach 1:
The patent extracts only the essential distribution characteristics from network traffic data, rather than maintaining and analyzing complete baseline profiles of normal behavior. By taking out only the critical distribution parameters (such as frequency distributions of events), the system achieves detection accuracy comparable to baseline methods while dramatically reducing system complexity and resource requirements.
Solution Approach 2:
The patent uses disposable distribution models that are computed on-demand rather than maintaining persistent baseline databases. These lightweight distribution models are created temporarily for analysis and discarded afterward, eliminating the need for complex baseline management infrastructure while maintaining detection accuracy.
3Measurement precision
If malware code signatures are used for detection, then detection precision for known threats is improved, but adaptability to new attacks deteriorates
Solution Approach 1:
The patent implements a universal distribution analysis approach that can detect multiple types of attacks (APT, low-and-slow attacks, and traditional malware) using the same underlying mechanism. By analyzing distribution characteristics rather than relying on attack-specific signatures, the system achieves both detection precision for known threats and adaptability to new attack types, as the distribution anomalies caused by different attack mechanisms share common mathematical properties.
Data Source
AI summary
Described technologies automatically detect computing system security attacks. Departure of occurrence distributions, which are based on leading digit(s) of digital item occurrence data, from model distributions that correspond to particular data sources, indicates a presence likelihood for particular attack types. Some model distributions exhibit Benford's Phenomenon. Described mechanisms detect security attack types such as ransomware, bitcoin mining, and others, using particular corresponding data sources such as file extensions, processor statistics, etc. Mechanisms detect security attacks without a captured baseline of healthy normal behavior, and without relying on malware code signatures. When an item occurrence distribution departs from a model distribution by at least a predefined degree, the technology electronically raises a security attack alert. Then countermeasures may be asserted for a possible type X security attack on the computing system. Countermeasures may include more computationally intensive tests for determining the precise extent or precise nature of an attack, for instance.