Correlation Fractal Dimension for Encrypted Malicious Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malicious network traffic detection methods are inefficient in distinguishing between encrypted malicious and non-malicious traffic, particularly due to high entropy flows, and are limited by the need for deep packet inspection, which is resource-intensive and ineffective for encrypted traffic.
Innovation Solution
The use of a correlation fractal dimension (CFD) evaluation method to identify malicious network traffic by comparing the CFD of network traffic with a reference measure, allowing for the detection of both unencrypted and encrypted malicious communications, and triggering protective measures such as terminating connections or adapting security levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to detect malicious traffic, then detection accuracy improves, but resource consumption increases and encrypted traffic cannot be effectively analyzed
Solution Approach 1:
The patent extracts only the essential features needed for malware detection (packet length, inter-arrival times, flow duration) from the complete packet data, eliminating the need for resource-intensive deep packet inspection while maintaining detection effectiveness. This selective feature extraction reduces processing overhead significantly.
Solution Approach 2:
The network traffic analysis is segmented into distinct phases (connection establishment, data transfer, connection termination) with specific sampling rates for each phase. This segmentation allows efficient resource usage by applying higher analysis intensity only where necessary while using lighter monitoring elsewhere.
2Reliability
If entropy-based methods are used to detect encrypted malicious traffic, then detection capability improves, but false positives increase due to high entropy in both malicious and non-malicious encrypted traffic
Solution Approach 1:
The patent applies different analysis methods to different phases of network communication. During connection establishment phase, it uses correlation fractal dimension analysis on timing patterns, while during data transfer phase it uses packet length distribution analysis. This localized approach to different traffic phases improves detection accuracy without increasing false positives.
Solution Approach 2:
The patent changes the detection parameters based on traffic phase and type. Instead of using fixed entropy thresholds, it dynamically adjusts sampling rates, analysis windows, and comparison criteria according to the specific phase of communication being analyzed, thereby improving reliability while maintaining precision.
3Productivity
If signature-based detection is used to identify known malware, then detection speed improves, but adaptability to new malware variants deteriorates
Solution Approach 1:
The patent uses correlation fractal dimension as a parameter that remains relatively stable across malware variants while capturing essential behavioral patterns. By comparing this dimension against reference values from known malware families, the system achieves both fast detection of known variants and adaptability to new variants that exhibit similar behavioral patterns.
Solution Approach 2:
The system performs preliminary analysis of network traffic patterns during the connection establishment phase, before full data transfer begins. This preliminary action using correlation fractal dimension allows early identification of potentially malicious traffic, enabling faster response and preventing resource consumption from analyzing obviously malicious traffic in detail.
Data Source
Figure 1~2a
Figure 2b
Figure 2c
AI summary
A method for identifying malicious network traffic communicated via a computer network, the method comprising: evaluating a measure of a correlation fractal dimension for a portion of network traffic over a monitored network connection; comparing the measure of correlation fractal dimension with a reference measure of correlation fractal dimension for a corresponding portion of network traffic of a malicious network connection so as to determine if malicious network traffic is communicated over the monitored network connection.