Endpoint-Network Telemetry Correlation for Encrypted Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network optimization techniques struggle to distinguish between business-critical and non-critical traffic due to the use of shared protocols, and malicious network traffic, particularly encrypted malware, evades detection by mimicking benign traffic patterns.
Innovation Solution
A service analyzes traffic telemetry data to infer application characteristics, correlates this with application telemetry data from a monitoring agent, and initiates mitigation actions when discrepancies indicate evasive malware, using machine learning-based classifiers to identify and block such traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If network traffic is encrypted to conceal malware activity, then malware detection difficulty increases, but network security is improved
Solution Approach 1:
The patent introduces an intermediary analysis layer that operates between the encrypted traffic and the detection system. Instead of directly analyzing encrypted payloads, the system uses traffic telemetry data (metadata, packet structure, communication patterns) as an intermediary to infer application characteristics and detect malware behavior without decrypting the traffic.
Solution Approach 2:
The patent replaces traditional mechanical decryption methods with a data-driven inference system. Instead of using decryption algorithms to examine malware payloads, the system substitutes this with machine learning models that analyze traffic patterns and metadata to detect malware characteristics, eliminating the need for payload decryption.
2Adaptability or versatility
If shared protocols are used for business and non-business traffic, then network compatibility is improved, but traffic distinction difficulty increases
Solution Approach 1:
The patent segments traffic analysis into multiple dimensions: protocol layer analysis, application layer behavior analysis, and host-based telemetry correlation. By dividing the analysis into these segments, the system can distinguish between business and non-business traffic using multiple criteria simultaneously, overcoming the limitations of shared protocols.
Solution Approach 2:
The patent adds new dimensions to traffic analysis by incorporating host-based application telemetry data, process information, and behavioral patterns. This dimensional expansion allows the system to distinguish traffic types beyond what protocol alone provides, enabling accurate differentiation between legitimate and malicious traffic despite shared protocols.
3Measurement precision
If traffic telemetry data is collected and analyzed to infer application characteristics, then malware detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by having the monitoring agent automatically collect, process, and correlate traffic telemetry data with application characteristics. The system performs self-diagnosis and self-adjustment through automated machine learning models that continuously refine their detection accuracy without requiring manual intervention, reducing operational complexity.
Solution Approach 2:
The patent dynamically changes analysis parameters based on detected traffic patterns and application characteristics. The system adjusts its detection thresholds, feature weights, and analysis depth in real-time based on learned patterns, optimizing detection accuracy while adapting to changing network conditions and avoiding fixed complex rule sets.
Data Source
AI summary
In one embodiment, a service receives traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network. The service analyzes the traffic telemetry data to infer characteristics of an application on the endpoint device that generated the encrypted traffic. The service receives, from a monitoring agent on the endpoint device, application telemetry data regarding the application. The service determines that the application is evasive malware based on the characteristics of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device. The service initiates performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.