Endpoint Packet Fingerprinting for Inline Malware Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Endpoints connected to networks, such as laptops and IoT devices, are vulnerable to malware and lack effective visibility and control over direct-to-internet traffic, with existing host-based firewalls failing to provide inline malware detection and blocking capabilities.
Innovation Solution
Integration of an on-device firewall and library agent with secure agents on endpoints for inline analysis using protocol fingerprints generated by an on-device malware detection engine, leveraging AI and ML models to identify malicious software and unauthorized processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If host-based firewalls are used to prevent malware attacks, then network security is improved, but visibility and control over direct-to-internet traffic deteriorates
Solution Approach 1:
The system segments the firewall functionality into two parts: a lightweight host-based firewall agent that provides basic blocking capabilities, and a cloud-based analysis service that performs deep packet inspection and generates fingerprints. This segmentation allows the host firewall to remain simple and fast while the cloud service provides comprehensive visibility and control over traffic patterns.
Solution Approach 2:
The patent introduces an intermediary cloud-based analysis service that acts as a mediator between the host firewall and the internet. This intermediary analyzes traffic patterns, generates behavioral fingerprints, and provides enhanced visibility without requiring the host firewall itself to perform complex analysis, thus maintaining both security and controllability.
2Reliability
If inline malware detection and blocking capabilities are added to host-based firewalls, then malware detection is improved, but device resource consumption increases
Solution Approach 1:
The patent extracts the computationally intensive malware detection and analysis functions from the host-based firewall and relocates them to a cloud-based service. The host firewall retains only lightweight packet filtering and forwarding capabilities, while the cloud service performs deep inspection, behavioral analysis, and fingerprint generation, thereby maintaining detection capability while minimizing local resource consumption.
Solution Approach 2:
The system creates a virtual copy of the traffic analysis capability in the cloud, allowing the host firewall to offload complex detection tasks. Instead of running resource-intensive detection algorithms locally, the host firewall sends traffic samples to the cloud where identical analysis capabilities are replicated and executed, reducing local computational burden while maintaining detection effectiveness.
3Measurement precision
If comprehensive packet inspection is performed, then malware detection accuracy is improved, but processing speed deteriorates
Solution Approach 1:
The system performs preliminary filtering and classification of packets at the host firewall level, identifying only those packets that require deep inspection. By pre-processing and prioritizing traffic before sending it to the cloud-based analysis service, the system ensures that comprehensive inspection is applied only where necessary, maintaining both detection accuracy and processing throughput.
Solution Approach 2:
The patent implements partial packet inspection where only critical portions of packets (headers, payload signatures, behavioral patterns) are analyzed in depth, while other packets receive standard processing. This selective approach achieves high detection accuracy for malicious traffic without applying full-comprehensive inspection to all packets, thus preserving processing speed while maintaining precision.
Data Source
AI summary
Aspects of the present disclosure are directed to on-device firewall and library agents integrated with secure agents on network connected endpoints. The on-device firewall and library agents enable inline analysis and inspection of data packets using protocol fingerprints generated for the data packets using an on-device malware detection engine. In one aspect, a network device includes a driver configured to capture a plurality of data packets received at the network device; and an on-device malware detection engine configured to receive at least a subset of the plurality of packets, and generate a fingerprint for the subset of the plurality of packets, the fingerprint being indicative of whether the plurality of data packets are associated with an external malware communication.