Dynamic Proxy Address Rotation for Malware Communication Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network access protection methods are inadequate in preventing malware from communicating with networks, even after compromising endpoints, as they fail to effectively protect against internal malware within the network.
Innovation Solution
A proxy system dynamically changes its address, receiving requests from endpoints, forwards them to the network, and updates its address using a key or algorithm, making it difficult for malware to maintain communication with the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a proxy uses a fixed address for network access protection, then the system is simple and easy to implement, but malware can maintain communication with the network by targeting the fixed address
Solution Approach 1:
The patent implements dynamic address changes for the proxy system. The proxy periodically changes its IP address or uses multiple addresses (such as through ANIC - Address Numbering for Identity and Location) to prevent malware from maintaining persistent communication. This dynamic approach transforms the static proxy address into a moving target, making it difficult for compromised endpoints to reliably contact the proxy for malware communication.
Solution Approach 2:
The system changes the address parameter of the proxy over time. By periodically updating the IP address or using address rotation mechanisms, the system modifies the critical parameter that malware would need to know to maintain communication. This parameter change approach directly addresses the reliability issue while managing complexity through automated address management.
2Object-affected harmful factors
If the proxy changes its address dynamically, then malware communication is prevented, but the system complexity increases
Solution Approach 1:
The proxy system performs self-service by automatically determining and updating its own address without requiring manual intervention. The system uses built-in mechanisms (such as ANIC or automated IP rotation) to manage address changes autonomously, reducing the operational complexity burden on administrators while maintaining the security benefit of dynamic addressing.
Solution Approach 2:
The system implements feedback mechanisms where the proxy monitors its own communication status and automatically adjusts its address based on detected conditions. This feedback loop allows the system to respond to malware communication attempts by changing addresses in response to detected patterns, thereby preventing malware while managing complexity through automated responses.
3Adaptability or versatility
If the proxy forwards all requests to the network, then legitimate traffic is allowed, but malware traffic is also permitted
Solution Approach 1:
The proxy acts as an intermediary between the endpoint and the network. It receives requests from endpoints, analyzes them against security policies, and selectively forwards only legitimate traffic to the network while blocking malware traffic. This intermediary position allows the proxy to maintain adaptability for legitimate access while providing reliable protection against malware through inspection and filtering capabilities.
Data Source
AI summary
In certain embodiments, a method includes receiving, at a first address of a proxy, a first request for access to a network from an application on an endpoint and forwarding, by the proxy, the request to the network on behalf of the application from the first address of the proxy. The method also includes determining, by the proxy, to change the address of the proxy from the first address to a second address and determining, by the proxy, the second address. Even further, the method includes changing, by the proxy, the address of the proxy to the second address. Moreover, the method includes receiving, at the second address of the proxy, a second request for access to the network from the application. The method also includes forwarding, by the proxy, the second request to the network on behalf of the application from the second address of the proxy.