Botnet Detection via Network Flow Correlation and User Notification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cable networks face challenges in detecting and mitigating botnets, which infect IoT devices and generate malicious network traffic, causing denial of service attacks, data exfiltration, and customer dissatisfaction.
Innovation Solution
A method and system for detecting and mitigating malicious botnets by obtaining threat information, generating a control list to identify suspicious network flows, logging and correlating addresses with user identifiers, and issuing notifications to affected users, while also blocking or rerouting malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network monitoring and detection systems are implemented to identify botnets, then security detection capability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The botnet detection system is segmented into multiple functional components: a monitoring component that collects network traffic data, an analysis component that processes the data using machine learning models, and a response component that executes mitigation actions. This segmentation allows each component to specialize in specific tasks, improving detection accuracy while managing system complexity through modular design.
Solution Approach 2:
The patent introduces an intermediary analysis layer between raw network traffic and detection decisions. This intermediary component uses machine learning models to process and interpret network data, acting as a mediator that transforms complex raw data into actionable security insights, thereby improving detection capability without directly increasing the complexity of core network infrastructure.
2Measurement precision
If comprehensive network traffic analysis is performed to detect malicious activity, then detection capability is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by pre-training machine learning models with extensive network traffic data before deployment. These pre-trained models can quickly classify new traffic as benign or malicious without requiring extensive real-time computation, thereby improving detection accuracy while minimizing processing time during actual security operations.
Solution Approach 2:
The patent implements partial analysis by focusing computational resources on suspicious traffic patterns rather than analyzing all network traffic equally. The system uses heuristic rules and lightweight filters to identify potentially malicious traffic, then applies more intensive analysis only to those specific flows, reducing overall processing time while maintaining high detection accuracy for actual threats.
3Reliability
If real-time botnet detection and notification systems are deployed, then security response effectiveness is improved, but system resource consumption increases
Solution Approach 1:
The notification system implements periodic action by sending alerts at strategically determined intervals rather than continuously. When botnet activity is detected, the system monitors the situation and sends notifications based on predefined thresholds and time intervals, ensuring timely security response while avoiding excessive resource consumption from continuous alerting and monitoring.
Data Source
AI summary
Method and systems for detecting and mitigating a malicious bot. Threat information is obtained, the threat information identifying one or more indicators of compromise (IOC) corresponding to suspected or known malicious network traffic. A control list (CL) corresponding to the threat information is generated, the CL describing rules for identifying network flows to be logged in a network log. The network log identifying the network flows is obtained and a suspect network flow identified by both the threat information and the network log is identified. An address corresponding to the suspect network flow is identified and the address is correlated with a user identifier. A notification is issued to a user associated with the user identifier, the notification indicating a suspected existence of a malicious bot.