Suspicious Encrypted Communication Detection Using Padded Traffic Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDS) are ineffective for encrypted communications, as they cannot decrypt and analyze encrypted data, leading to low determination accuracy and susceptibility to attacks, and existing methods for analyzing encrypted communications without decryption are easily bypassed by attackers.
Innovation Solution
A suspicious communication detection apparatus and method that uses a database to manage encrypted and non-encrypted communication data separately, performs padding to fill differences in transmission and reception sizes, and employs a machine learning model trained on non-encrypted communication data to determine if encrypted communications are suspicious, without decrypting them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If encrypted communications are analyzed after decryption, then determination accuracy improves, but communication security deteriorates
Solution Approach 1:
The patent introduces a mediator component that extracts features from encrypted communications without full decryption. This intermediary approach allows analysis of communication patterns, packet sizes, and metadata while keeping the actual encrypted payload secure, thus resolving the contradiction between analysis accuracy and communication security.
Solution Approach 2:
The patent extracts only the necessary features (packet size, timing, frequency, metadata) from encrypted communications for analysis, leaving the actual encrypted content intact. This extraction approach enables determination accuracy without compromising the security of the encrypted communication stream.
2Reliability
If encrypted communications are analyzed using unencrypted information (header, TLS handshake), then communication security is maintained, but determination accuracy deteriorates
Solution Approach 1:
The patent moves the analysis from the content dimension (which would require decryption) to the dimensional space of metadata, packet characteristics, and statistical features. By analyzing encrypted communications in this alternative dimension, the system maintains security while improving determination accuracy through multi-dimensional feature extraction.
Solution Approach 2:
The patent changes the parameters being analyzed from encrypted content to unencrypted observable parameters such as packet size, transmission timing, frequency, and sequence patterns. This parameter transformation enables accurate determination while maintaining communication security.
3Reliability
If statistical information is used for determination without decryption, then communication security is maintained, but determination accuracy deteriorates due to lack of payload information
Solution Approach 1:
The patent employs dynamic analysis of encrypted communications by continuously monitoring and analyzing temporal patterns, packet sequence variations, and behavioral characteristics. This dynamic approach extracts meaningful features from the flow of encrypted data without decryption, improving determination accuracy while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where determination results are continuously refined based on accumulated statistical information and pattern recognition. The feedback loop enables the system to improve accuracy over time by learning from observed encrypted communication patterns without ever requiring decryption.
Data Source
AI summary
An apparatus, method, and program for detecting suspicious communications are described herein. In some implementations, the method includes managing received communications in a database by separating them as encrypted communications and as non-encrypted communications; determining whether each received communication is an encrypted communication or a non-encrypted communication; performing padding on transmission and reception size values and transmission and reception packet numbers of the non-encrypted communication to fill in a difference from the encrypted communication; generating features from the non-encrypted communication obtained after padding and registering the features in the database; training a machine learning model by using features of the non-encrypted communications registered in the database as training data; referring to the database by using information about a received encrypted communication; entering obtained features about the received encrypted communication to the machine learning model; and determining whether the received encrypted communication is a suspicious communication.