Bipartite Graph Malware Detection for C2 Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques are ineffective against hackers who design malware systems to evade detection by communicating with multiple command and control devices and frequently changing the set of devices used, making it difficult to identify and blacklist malicious infrastructure.
Innovation Solution
A process involving the generation of a bipartite graph to identify potentially infected internal devices and malware command and control devices by analyzing communication logs, eliminating whitelisted devices and destinations, and isolating clusters based on degree of isolation and connectivity, allowing for the detection of transient malware command and control devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a blacklist is used to block known malware command and control infrastructure, then detection effectiveness is improved for known threats, but malware can evade detection by communicating with multiple devices and changing the set of devices over time
Solution Approach 1:
The patent segments the communication network into internal devices and external destinations, representing their interactions as a bipartite graph. This segmentation allows the system to analyze communication patterns at a structural level rather than relying on individual device blacklisting, enabling detection of coordinated malware behavior across multiple devices.
Solution Approach 2:
The patent transitions from traditional one-dimensional blacklisting (individual device blocking) to a two-dimensional graph-based approach that simultaneously considers multiple devices and their communication relationships. By adding the dimension of relational structure, the system can detect malware that adapts by changing individual device identities.
2Object-affected harmful factors
If malware communicates with multiple command and control devices simultaneously, then detection difficulty increases, but this enables covert bi-directional communication channels that blend with legitimate traffic
Solution Approach 1:
The patent merges multiple communication streams into a unified graph structure where internal devices and external destinations are nodes and their interactions are edges. This combining allows the system to analyze the collective behavior of multiple malware-infected devices and their command and control infrastructure as an integrated pattern, making covert communications detectable through their relational structure.
Solution Approach 2:
The bipartite graph structure serves multiple functions: it represents communication relationships, enables pattern recognition, identifies clusters of suspicious devices, and detects both known and unknown malware behaviors. This multi-functional approach handles diverse malware strategies uniformly without requiring separate detection mechanisms.
3Duration of action of stationary object
If the set of malware command and control devices changes frequently, then blacklist effectiveness decreases, but new detection techniques are needed that can identify transient devices
Solution Approach 1:
The patent performs preliminary analysis by constructing the bipartite graph and identifying clusters of devices with suspicious communication patterns before malware can change its infrastructure. By pre-processing communication logs and establishing baseline patterns, the system is positioned to detect deviations when malware attempts to evade detection by changing devices.
Solution Approach 2:
The system continuously monitors communication patterns and updates its understanding of device relationships over time. When new devices are introduced or patterns change, the graph structure adapts to reflect current communication flows, providing ongoing feedback that maintains detection effectiveness even as malware infrastructure evolves.
Data Source
AI summary
Potentially infected internal device(s) and potential malware command and control device(s) are identified by generating a bipartite graph that includes internal device(s) inside a network and destination(s) outside the network which communicate over a period of time. The bipartite graph is reduced to obtain a reduced bipartite graph, including by eliminating those connections that include a whitelisted internal device and those connections that include a whitelisted destination. From the reduced graph, a cluster of potentially infected internal device(s) and potential malware command and control device(s) are identified based at least in part on (1) the cluster's degree of isolation from other clusters and (2) an isolation threshold.