Identifying Command and Control Computers via Link Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying command and control center computers within a network is challenging due to their ability to disguise communication patterns and the difficulty in distinguishing malware attacks from normal network activity.
Innovation Solution
A system that analyzes data traffic information to identify communication links between internal and external computers, groups computers based on similar communication patterns, and flags clusters with anomalous behavior as potentially infected, using matrix factorization and clustering techniques to distinguish between normal and malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If communication content analysis is used to identify command and control centers, then identification accuracy improves, but system complexity and processing time increase
Solution Approach 1:
The patent extracts only the essential communication link metadata (source/destination addresses, timing information) from the complete communication content, discarding unnecessary detailed content while retaining sufficient information for identification. This extraction approach maintains identification accuracy while significantly reducing system complexity and processing requirements.
Solution Approach 2:
The patent segments the communication analysis into distinct components: communication link identification, pattern extraction, and anomaly detection. By dividing the analysis process into separate modular components working on specific data aspects, the system achieves high identification accuracy without requiring complex integrated processing of all communication details.
2Measurement precision
If communication content analysis is performed to detect malware attacks, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent extracts only critical timing metadata (communication intervals, duration patterns) from complete communication content, enabling rapid detection of malware patterns without time-consuming analysis of full communication payloads. This maintains detection accuracy for timing-based anomalies while dramatically reducing processing time.
Solution Approach 2:
The patent performs partial analysis by focusing only on the most discriminative features (communication timing patterns) rather than analyzing all communication content. This partial action approach achieves sufficient detection accuracy for malware identification while minimizing processing time requirements.
3Measurement precision
If detailed communication pattern analysis is used to distinguish malware from normal activity, then detection accuracy improves, but computational resources increase
Solution Approach 1:
The patent extracts only the most relevant computational features (communication link patterns, timing intervals) from complete communication data, eliminating unnecessary computational analysis of redundant information. This extraction strategy maintains high detection accuracy while significantly reducing computational resource consumption.
Solution Approach 2:
The patent segments computational analysis into focused tasks: pattern extraction from metadata, clustering computation on simplified features, and anomaly detection on aggregated statistics. This segmentation reduces overall computational requirements while preserving detection accuracy by analyzing only essential features at each stage.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media for identifying malware attacks collects data traffic information. A system receives data traffic information indicative of communications between computers within a network and computers external to the network. The system parses the data traffic information to identify communication links between the computers within the network and computers external to the network. The system can generate communication link profiles for each of the computers within the network. The system can then group computers within the network into computer clusters based on similarities between the communication link profiles for each computer. The system can identify computer clusters having anomalous communication patterns as being indicative of a malware attack.