Encrypted Communication Suspicion Detection via Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting suspicious encrypted communications face challenges in determining accuracy, especially for inbound communications, as they rely on statistical information and are vulnerable to evasion techniques by attackers.
Innovation Solution
A suspicious communication detection apparatus and method that utilize a database to manage information from encrypted communications and a machine learning model to determine suspicious communications without decrypting them, incorporating a redetermination process for enhanced accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted communication is analyzed by using information that has not been encrypted (e.g., header or TLS handshake), then the communication security is maintained during transmission, but the determination accuracy is low and attackers can easily avoid detection
Solution Approach 1:
The patent introduces a machine learning model as an intermediary that processes encrypted communication data. The model receives encrypted packets and their metadata, performs analysis without decryption, and outputs suspicion determinations. This intermediary approach enables accurate detection while preserving encryption security.
Solution Approach 2:
The patent transforms the analysis approach by changing from traditional signature-based detection to machine learning-based detection using statistical parameters. The system extracts features from encrypted communications (packet sizes, timing, protocol behavior) and feeds them to an ML model that determines suspicious activity, improving accuracy without compromising encryption.
2Reliability
If determination is performed without decrypting the encrypted communication, then communication security is maintained, but payload information cannot be used for determination leading to low determination accuracy
Solution Approach 1:
The patent extracts useful information from encrypted communications without decrypting the payload. It extracts metadata such as packet sizes, transmission timing, protocol headers, and connection patterns, which are sufficient for machine learning-based detection. This extraction enables accurate determination while maintaining security.
Solution Approach 2:
The patent replaces traditional mechanical decryption and analysis methods with a machine learning-based system. Instead of manually analyzing decrypted payload content, the system uses ML algorithms to detect suspicious patterns in encrypted data characteristics, achieving high accuracy without payload decryption.
3Ease of operation
If statistical information is used for determining suspicious communications, then the determination can be performed without decryption, but the determination accuracy is low especially for inbound encrypted communications
Solution Approach 1:
The patent enhances statistical parameter analysis by introducing machine learning models that process multiple communication parameters simultaneously. The system analyzes packet sizes, timing intervals, protocol behavior, and connection patterns through ML algorithms, transforming basic statistical detection into intelligent pattern recognition that works effectively for both outbound and inbound communications.
Solution Approach 2:
The patent implements a feedback mechanism where determination results are stored and used to refine future detections. The system learns from past communication patterns and adjusts its detection criteria, improving accuracy over time for both outbound and inbound encrypted communications through continuous feedback from determined results.
4Adaptability or versatility
If attackers use different IP addresses and fake normal TLS handshake, then they can avoid detection by existing techniques, but this increases the complexity of detection
Solution Approach 1:
The patent creates a universal detection system that handles multiple attack vectors through a single machine learning model. The model is trained to recognize various suspicious patterns including IP address changes, fake TLS handshakes, and abnormal communication behaviors, making the system adaptable to different attacker techniques without requiring separate detection mechanisms for each threat type.
Data Source
AI summary
A suspicious communication detection apparatus includes: a database; a machine learning model that receives features of an encrypted communication and that determines whether the encrypted communication is a suspicious communication; a determination part that refers to the database by using information about a received encrypted communication, enters obtained features about the received encrypted communication to the machine learning model, determines whether the received encrypted communication is a suspicious communication, and stores the determination result for the suspiciousness in the database; and a redetermination part that performs, based on a determination result of an encrypted communication from the inside of the organization to the outside of the organization, a redetermination on a determination result of an encrypted communication from the outside of the organization to the inside of the organization, the determination result being stored in the database.