Malicious Network Resource Detection via External Service Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity methods for detecting malicious network resources often result in false-positive responses, leading to an unjustified burden on cybersecurity systems, as they struggle to differentiate between legitimate and malicious traffic, especially when traffic is encrypted.
Innovation Solution
An active detection method using an external computing device outside the protected network infrastructure to scan suspicious IP addresses, comparing service lists with known malicious services and determining ownership intervals to accurately identify malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning models are used for traffic analysis to detect malicious activity, then detection capability is improved, but false-positive rate increases
Solution Approach 1:
The patent segments the detection process into multiple independent analysis components: initial traffic filtering, machine learning-based anomaly detection, and secondary verification through service scanning. This segmentation allows each component to focus on specific aspects, reducing false positives while maintaining detection capability
Solution Approach 2:
The patent introduces an intermediary verification step between initial detection and final confirmation. When machine learning models flag suspicious traffic, the system performs additional service scanning and analysis before generating alerts, acting as a mediator to filter out false positives
2Reliability
If traffic analysis is performed on encrypted data, then detection coverage is improved, but analysis accuracy deteriorates
Solution Approach 1:
The patent employs nested analysis layers where external scanning and service detection are performed within the encrypted traffic context. The system nests multiple verification mechanisms (service scanning, port analysis, response time measurement) within the encrypted data stream analysis, allowing comprehensive detection without requiring decryption
Solution Approach 2:
The patent replaces direct content inspection (mechanical reading of data) with indirect observation methods. Instead of attempting to read encrypted content, the system substitutes analysis of traffic patterns, service responses, port behavior, and temporal characteristics to infer malicious activity
3Measurement precision
If active scanning of suspicious IP addresses is performed, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The patent applies partial scanning by focusing resources only on suspicious IP addresses identified through initial traffic analysis. Instead of scanning all network traffic comprehensively, the system performs targeted active scanning only on flagged addresses, reducing overall resource consumption while maintaining detection accuracy for critical threats
Solution Approach 2:
The patent applies different levels of analysis intensity to different traffic segments. High-resource active scanning is applied locally only to suspicious IP addresses, while routine traffic receives minimal processing. This local quality approach optimizes resource allocation by matching analysis depth to threat level
Data Source
AI summary
A method and system for detection of malicious network resources in a distributed computer system are provided. The method comprises: receiving, by a first computing device, disposed inside the distributed computer system, an outbound traffic, detecting, by the first computing device, a suspicious external IP address in the outbound traffic, scanning, by the first computing device, a suspicious device located at the suspicious IP address to obtain a list of services running thereon, transmitting, by the first computing device, the suspicious IP address and the list of services to a second computing device disposed outside the distributed computer system, comparing, by the second computing device, the list of services with known malicious services, and in response to a match between at least one service from the list of services and a respective one of the known malicious services: determining the suspicious device, at the suspicious IP address, as being malicious.