Byte Stream Complexity Anomaly Detection for Malicious Activity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks face challenges in detecting and preventing malicious software due to its increasingly sophisticated methods of evading detection, such as obfuscation, which makes it difficult to identify potentially malicious data streams.
Innovation Solution
A computing device measures the complexity of byte streams using compressibility and entropy, comparing them to thresholds determined from benign data streams to identify anomalies, triggering security notifications or preventing transmission of anomalous files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection methods are used to identify malicious software, then detection simplicity is maintained, but detection effectiveness deteriorates due to sophisticated obfuscation techniques
Solution Approach 1:
The patent changes the detection parameter from content-based analysis to complexity-based analysis. Instead of examining file contents directly, the system measures complexity metrics (entropy, compressibility, code density) of the data streams. This parameter transformation allows detection of obfuscated malicious software by identifying abnormal complexity patterns rather than relying on traditional signature matching or heuristic analysis.
2Measurement precision
If complexity measurement is applied to all data streams, then detection precision is improved, but processing time increases
Solution Approach 1:
The system applies complexity measurement selectively rather than uniformly to all data. It first identifies candidate data streams for analysis and then applies complexity metrics only to those candidates. This partial action approach maintains high detection precision for suspicious files while reducing overall processing time by avoiding unnecessary analysis of benign files.
Solution Approach 2:
The patent implements preliminary filtering to identify data streams that warrant complexity analysis. By pre-screening data streams using basic criteria before applying computationally intensive complexity measurements, the system prepares only the necessary subset of files for detailed analysis, thereby reducing total processing time while maintaining detection precision.
Data Source
AI summary
Examples relate to identifying malicious activity using data complexity anomalies. In one example, a computing device may: receive a byte stream that includes a plurality of bytes; determine, for a least one subset of the byte stream, a measure of complexity of the subset; determine that the measure of complexity meets a predetermined threshold measure of complexity for a context associated with the byte stream; and in response to determining that the measure of complexity meets the threshold, provide an indication that the byte stream complexity is anomalous.