External Computer Threat Tracking Through Instruction-Based System Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in effectively identifying potential attackers by relying solely on comparing actual requests with a request database, which may not accurately detect new threats and increases data traffic without providing relevant information for protection.
Innovation Solution
A method and system that categorize an external computer system as a potential threat, generate a computer file with instructions to obtain information on the external system, send data with the file, receive and preserve information for protection, using AI-modules and decoy servers to reduce detection risks and data traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection systems compare actual requests with a request database to detect potential attackers, then threat detection capability is improved, but data traffic increases without providing relevant protection information
Solution Approach 1:
The patent extracts only the essential protective information from the request database comparison, rather than transmitting entire request profiles. The system identifies and transmits only relevant threat indicators and protection parameters, reducing data traffic while maintaining detection reliability.
Solution Approach 2:
The request database is segmented into multiple categories (e.g., attack patterns, system fingerprints, protection rules). The system selectively compares and transmits only the relevant segments matching the actual request, avoiding unnecessary data transmission while preserving threat detection accuracy.
2Reliability
If the system obtains detailed information about external computer systems, then protection measures can be customized, but the external system may detect malware or suspicious activity
Solution Approach 1:
The patent introduces an intermediary analysis layer that processes external system information indirectly. Instead of directly querying the external system (which could trigger malware detection), the system uses intermediate request databases and proxy comparison mechanisms to gather necessary protection information without direct exposure.
Solution Approach 2:
The system uses temporary, disposable request profiles and comparison data that are generated, used immediately for protection customization, and then discarded. These short-lived objects minimize the window of exposure and reduce the chance of malware detection, while still enabling effective customized protection.
3Loss of information
If the system transmits computer files with instructions to external systems, then information gathering capability is improved, but the risk of detection and false positive increases
Solution Approach 1:
The patent designs computer files with universal, benign instructions that serve multiple functions: they gather necessary system information while simultaneously appearing as legitimate operational code. The same file structure is used for both information gathering and normal system communication, reducing suspicion and detection risk.
Solution Approach 2:
The system dynamically changes parameters of the transmitted computer files based on the external system's response patterns and threat level. Instructions are adjusted in real-time to modify their appearance and behavior, making detection more difficult while maintaining information gathering effectiveness.
Data Source
AI summary
A computer-implemented method obtains information about an external computer system having a connection to a computer system. The method may comprise receiving a request from the external computer system. In response to categorizing the external computer system as a potential threat responsive to the request, a computer file is generated responsive to the request. The computer file comprises instructions which are designed for obtaining the information about the external computer system if the instructions are executed on a processor of the external computer system. Furthermore, data is provided responsive to the request. The data is sent together with the computer file to the external computer system. The information about the external computer system, which is generated responsive to the instructions of the computer file, is received by the computer system for preserving it for a later use for developing measures for protecting the computer system.