Clustering-Based Periodic Behavior Detection in Network Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting periodic behavior in communication sessions, such as those associated with malware attacks, face challenges including high computational complexity, limited accuracy, and the need for prior knowledge of periodic intervals, which can lead to missed detections and resource-intensive processing.
Innovation Solution
A clustering-based method that identifies periodic behavior by analyzing timestamp differences in network sessions using a clustering algorithm, reducing the need for complex transforms and allowing for the detection of multiple periods, thereby enhancing performance and accuracy in identifying suspicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional techniques are used to detect periodic behavior in communication sessions, then detection capability is provided, but computational complexity increases and accuracy is limited
Solution Approach 1:
The patent segments the detection process into distinct phases: extracting timestamp differences from communication events, clustering these differences using a clustering algorithm to identify periodic patterns, and separately evaluating periodicity based on cluster characteristics. This segmentation reduces computational complexity by breaking down the complex detection task into manageable steps while improving accuracy through focused analysis at each stage.
Solution Approach 2:
The patent changes the approach from analyzing raw communication timestamps directly to analyzing the differences between consecutive timestamps. This parameter transformation simplifies the detection problem by converting absolute time values into relative intervals, making periodic patterns more apparent and easier to detect with lower computational overhead while maintaining or improving detection accuracy.
2Adaptability or versatility
If conventional detection methods are applied, then periodic communications can be identified, but the need for prior knowledge of periodic intervals limits detection capability
Solution Approach 1:
The clustering algorithm automatically determines periodic intervals by analyzing the distributed timestamp differences without requiring pre-configured knowledge of expected periods. The algorithm self-adapts to the actual communication patterns in the data, identifying periodicity emergently from the clustered time differences. This eliminates the need for prior knowledge while maintaining high detection accuracy and reducing missed detections.
3Reliability
If complex transform techniques are used for periodicity detection, then detection capability is provided, but resource consumption increases
Solution Approach 1:
The patent replaces computationally expensive complex transform techniques with a simpler clustering-based approach that uses basic statistical operations on timestamp differences. The clustering algorithm processes time differences using straightforward distance calculations and mean computations, which are significantly less resource-intensive than complex transforms. This substitution maintains detection reliability while dramatically reducing computational resource consumption and energy usage.
Data Source
AI summary
Methods and apparatus are provided for detecting periodic behavior in a communication session using clustering. An exemplary method comprises obtaining a set of differences between timestamps of adjacent events for a given network session; assigning each difference in the set to a cluster using a clustering technique based on a distance between the difference and a mean time difference for each cluster; and providing clusters generated by the clustering technique, wherein each of the differences in each of the clusters correspond to events exhibiting periodic behavior with a period substantially equal to the mean time difference of the assigned cluster. The differences are optionally obtained and processed in real-time. The periodicity of a given cluster is measured, for example, based on a variance of the differences assigned to the given cluster. The clusters are optionally processed to identify suspicious communications associated with a computer security attack.