Malicious Campaign Signatures Using Abused Benign Entity Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection mechanisms for malicious campaigns struggle to differentiate between benign and malicious network activities, leading to false positives and inefficiencies in identifying malicious campaigns.
Innovation Solution
A signature generator that aggregates data from multiple malicious campaigns to identify a combination of highly abused benign network entities, creating a signature to detect malicious campaigns without impeding benign traffic, using graph-based analysis and evaluation to ensure accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If detection mechanisms search network traffic for particular network entities by URLs and block suspicious URLs, then malicious campaign detection capability is improved, but false positives increase and benign traffic is impeded
Solution Approach 1:
The patent segments the detection approach by breaking down malicious campaigns into individual network entities (URLs, domains, IPs, hostnames) and analyzing their co-occurrence patterns separately. Instead of treating each URL in isolation, the system segments them into entities and examines their relationships through graph structures, allowing detection based on combinations rather than individual suspicious URLs.
Solution Approach 2:
The patent adds a new dimension to detection by moving from single-entity detection to multi-entity combination detection. It constructs graph structures where nodes represent network entities and edges represent co-occurrence relationships, transforming the detection problem from one-dimensional (individual URL analysis) to multi-dimensional (combination patterns across multiple entities).
2Measurement precision
If detection mechanisms use known malicious domains as seed domains to identify clusters, then detection accuracy is improved, but the complexity of detection mechanisms increases
Solution Approach 1:
The patent creates a universal graph structure that can detect multiple types of network entities (URLs, domains, IP addresses, hostnames) using the same co-occurrence analysis framework. The graph-based approach serves multiple functions: it identifies malicious campaigns, clusters related entities, and detects patterns across different entity types, replacing multiple specialized detection mechanisms with a single unified system.
Solution Approach 2:
The patent uses graph structures as a copyable, reusable data model that can represent different malicious campaign patterns. Once a graph structure is built from training data representing malicious campaigns, it can be copied and applied to detect similar patterns in new traffic, eliminating the need to redesign detection mechanisms for each specific campaign type.
3Productivity
If a signature is created to detect malicious campaigns, then detection efficiency is improved, but benign traffic may be impeded
Solution Approach 1:
The patent applies partial action by creating detection signatures that match specific combinations of network entities rather than requiring all entities to be present or absent. The system identifies that certain combinations of entities (URLs, domains, IPs, hostnames) co-occurring together indicate malicious campaigns, while allowing individual entities to pass if they don't form the harmful combination. This partial matching approach improves efficiency while reducing false positives.
Data Source
AI summary
A signature generator has been designed that can create a malicious campaign signature with substantial coverage of malicious campaign behavior without impeding benign traffic. The malicious campaign signature generator uses data of multiple, known malicious campaigns to identify abused, benign network entities. The signature generator builds a graph data structure for each malicious campaign that represents the abused network entities. The relationships encoded in the graph data structure indicate the use of the combination of abused network entities in the campaign. The signature generator aggregates the graph data structures and identifies a combination of the benign network entities that were highly abused across the multiple malicious campaigns with respect to all of the abused network entities represented in the graph data structures. A signature is then created from the identifiers of this combination of highly abused network entities.