Bind Shell Attack Detection via Connection Pair Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems in computer networks are inadequate in detecting bind shell attacks, which involve unauthorized access and data theft through lateral movement by exploiting vulnerabilities and using different ports for initial and follow-up connections.
Innovation Solution
A method that collects and groups data packets by source and destination entities and times, identifies pairs of connections within a specified time window, generates features for these connections, and evaluates them using a processor to detect malicious activity, such as bind shell attacks, by applying rules and noise detectors to identify suspicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-virus software and intrusion detection systems are used, then basic security protection is provided, but bind shell attacks involving lateral movement and port exploitation cannot be detected
Solution Approach 1:
The patent segments network traffic analysis into connection pairs, examining sequences of two connections rather than isolated connections. This segmentation allows detection of bind shell attacks by analyzing the relationship between initial exploitation connections and follow-up shell connections, capturing the lateral movement pattern that traditional single-connection analysis misses.
Solution Approach 2:
The patent adds a temporal and sequential dimension to network traffic analysis by examining pairs of connections within time windows. This dimensional change from static single-connection analysis to dynamic multi-connection sequence analysis enables detection of attack patterns that unfold over time, such as bind shell attacks involving port changes and lateral movement.
2Difficulty of detecting and measuring
If network traffic analysis is performed on individual connections, then basic protocol violations are detected, but coordinated attack patterns across multiple connections are missed
Solution Approach 1:
The patent performs preliminary grouping of connections into pairs based on time windows and entity relationships before detailed analysis. This preliminary action organizes the data structure to facilitate efficient pattern recognition, allowing the system to focus computational resources on evaluating connection pairs that exhibit suspicious characteristics rather than analyzing all connections individually.
Solution Approach 2:
The patent implements dynamic evaluation of connection pairs using multiple features including time differences, port changes, and data transfer patterns. The system adapts its analysis based on the specific characteristics of each connection pair, adjusting evaluation criteria to identify various types of coordinated attacks including bind shell attacks, making the detection system both sophisticated and adaptable.
Data Source
AI summary
Methods, apparatus and computer program products implement embodiments of the present invention that include collecting data packets transmitted between multiple entities over a network, and grouping the packets at least according to their source and destination entities and their times, into connections to which the packets belong. Pairs of the connections are identified having identical source and destination entities and times that are together within a specified time window, and sets of features are generated for the identified pairs of the connections. The features in the pairs are evaluated in order to detect a given pair of connections indicating malicious activity, and an alert is generated for the malicious activity.