Endpoint-Network Telemetry Correlation for Evasive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network optimization techniques struggle to distinguish between business-critical and non-critical traffic due to the use of similar protocols, and malicious network traffic, especially encrypted malware, is difficult to detect as it conceals its activity.
Innovation Solution
A service analyzes traffic telemetry data to infer application characteristics, correlates this with application telemetry data from a monitoring agent, and initiates mitigation actions when discrepancies indicate evasive malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect legitimate application traffic, then network security is improved, but detection of malicious traffic becomes more difficult
Solution Approach 1:
The patent transitions from analyzing encrypted payload content (which is obscured) to analyzing metadata dimensions such as TLS handshake characteristics, DNS query patterns, HTTP header structures, and traffic flow behaviors. This dimensional shift allows detection of malicious traffic patterns without requiring decryption of the encrypted payload, thus maintaining security while improving detectability.
Solution Approach 2:
The system changes the parameters being analyzed from application-layer payload content to network-layer and transport-layer metadata parameters. By focusing on TLS version, cipher suite selection, handshake timing, packet size distributions, and flow duration, the system can identify malicious traffic characteristics that differ from legitimate traffic patterns even when both are encrypted.
2Productivity
If protocol-based traffic classification is used, then network traffic can be managed, but distinction between business-critical and non-critical traffic becomes difficult
Solution Approach 1:
The patent segments the traffic identification process into multiple independent analysis components: TLS handshake analysis, DNS query analysis, HTTP header analysis, and traffic flow pattern analysis. Each component extracts specific features that collectively enable precise application identification beyond what any single protocol-based method could achieve alone.
Solution Approach 2:
The system creates a multi-functional identification framework that simultaneously analyzes multiple protocol layers (DNS, TLS, HTTP) and multiple traffic dimensions (timing, size, frequency, pattern). This universal approach enables the same system to identify diverse applications including video collaboration, cloud applications, and other business-critical services that all use HTTPS, by looking at their unique behavioral signatures across multiple dimensions.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
In one embodiment, a service receives traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network. The service analyzes the traffic telemetry data to infer characteristics of an application on the endpoint device that generated the encrypted traffic. The service receives, from a monitoring agent on the endpoint device, application telemetry data regarding the application. The service determines that the application is evasive malware based on the characteristics of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device. The service initiates performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.