Entropy-Based Malicious Encrypted Network Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malicious network traffic detection systems are ineffective in identifying encrypted traffic, as they rely on patterns and behavior analysis, which can lead to false positives and fail to distinguish between malicious and non-malicious encrypted communications, especially when malware communicates over encrypted channels.
Innovation Solution
A system that estimates entropy for network traffic using a streaming algorithm and compares it to a reference measure to identify malicious encrypted traffic, employing a Fourier transform coefficient evaluation as an alternative method to differentiate between legitimate and malicious encrypted communications by analyzing specific characteristics of the connection setup portion of network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malicious traffic detection mechanisms are used, then detection can be performed using network traffic interception and analysis, but detection of encrypted malicious traffic is ineffective
Solution Approach 1:
The patent changes the detection parameter from content-based analysis to entropy-based analysis. By calculating entropy values of network traffic packets and comparing them against thresholds, the system can detect encrypted malicious traffic without needing to decrypt or analyze the actual content, thus resolving the contradiction between maintaining detection effectiveness and dealing with encrypted traffic
Solution Approach 2:
The patent replaces the mechanical approach of deep packet inspection and pattern matching with a mathematical approach using entropy calculation. This substitution allows the system to effectively analyze encrypted traffic by measuring its informational content rather than attempting to interpret its semantic meaning
2Measurement precision
If deep packet inspection is used to detect malicious traffic patterns, then specific patterns can be identified, but false positives increase and accuracy decreases for encrypted traffic
Solution Approach 1:
The patent transitions from analyzing traffic content patterns to analyzing traffic entropy characteristics. This parameter change eliminates false positives associated with pattern matching while maintaining high accuracy in identifying malicious encrypted traffic through its distinctive entropy profile
Solution Approach 2:
The patent focuses analysis on specific portions of network traffic (individual packets or flows) rather than attempting to analyze entire communication sessions. This localized approach to entropy measurement improves precision by capturing the distinctive characteristics of malicious traffic in specific segments without being confounded by legitimate traffic variations
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method comprising: defining, for the malware, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware; extracting the defined portion of network traffic for each of a plurality of disparate network connections for the malware; evaluating a metric for each byte in each extracted portion; representing each extracted portion in a matrix data structure as an image of pixels wherein each pixel corresponds to a byte of the extracted portion; training a neural network based on the images for the extracted portions such that subsequent network traffic can be classified by the neural network to identify malicious network traffic associated with the malware based on an image generated to represent the defined portion of the subsequent network traffic.