Blacklist Generating System Using Communication Pattern Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for generating blacklists are limited in recognizing malicious URLs, leading to false detection and inadequate coverage of malware, as they rely on accessing suspicious URLs and determining destinations of malware communication, which can result in false positives and limited detectable malware.
Innovation Solution
A blacklist generating system that collects and analyzes communication logs from malware and normal network communications, calculates statistics on communication patterns, and creates a blacklist by excluding patterns found in a whitelist, thereby reducing false detection and enhancing malware detection coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional methods access suspicious URLs to determine maliciousness, then detection accuracy for recognized malicious URLs is improved, but coverage of detectable malware is limited and false detection increases
Solution Approach 1:
The patent segments the blacklist generation process into multiple independent analysis dimensions: communication destination analysis, communication timing analysis, communication volume analysis, and communication frequency analysis. Each dimension independently evaluates suspicious URLs based on specific metrics, allowing the system to detect malware through multiple pathways rather than relying on a single method, thus improving both accuracy and coverage while reducing false positives through cross-validation
2Adaptability or versatility
If all destinations of malware communication are added to blacklist, then coverage of malware detection is improved, but false detection rate increases
Solution Approach 1:
The patent divides the evaluation of communication destinations into four separate analytical functions, each focusing on a specific aspect (destination, timing, volume, frequency). A destination is only blacklisted when it fails multiple independent evaluation criteria simultaneously, rather than being blacklisted based on a single metric. This multi-dimensional segmentation approach ensures comprehensive malware coverage while maintaining high reliability by requiring consistent evidence across multiple analysis dimensions before adding to blacklist
Solution Approach 2:
The system implements feedback mechanisms where communication logs are continuously monitored and analyzed. The evaluation results from each analysis function feed into the overall blacklist determination process, and the blacklist is dynamically updated based on accumulated evidence. This feedback loop allows the system to distinguish between legitimate high-traffic destinations and actual malware destinations, reducing false detection while maintaining comprehensive coverage
Data Source
AI summary
A blacklist generating device acquires a malicious communication log and a normal communication log. A malicious communication profile extracting function calculates statistics on communication patterns included in the malicious communication log and outputs a communication pattern satisfying a certain condition to a potential blacklist. A normal communication profile extracting function calculates statistics on communication patterns included in the normal communication log and outputs a communication pattern satisfying a certain condition to a whitelist. A blacklist creating function searches the potential blacklist for a value with the value on the whitelist, excludes a coincident communication pattern from the potential blacklist, and creates a blacklist.