Malware Detection via Host Communication Fan-Out Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques are ineffective in identifying slow scanning malware and distributed scanning malware in enterprise networks, as these threats employ stealthy scanning techniques that evade signature-based detection and traffic anomaly analysis.
Innovation Solution
A method and system that monitor packet traffic to identify infected hosts by constructing measurement period lists and accumulating statistics to derive count values, selectively attributing hosts that communicate with abnormally high numbers of other hosts as potentially infected, using fan-out and fan-in lists, and excluding known high-traffic hosts like email servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature-based detection methods are used to identify malware, then detection can be performed with simple comparison operations, but the method becomes ineffective against stealth worms that change signatures or employ slow/distributed scanning techniques
Solution Approach 1:
The patent changes the detection parameter from signature matching to traffic pattern analysis. Instead of comparing packet signatures against known malware signatures, the system monitors communication patterns between hosts, counting the number of unique hosts each host communicates with over time. This parameter change enables detection of stealth worms that modify their signatures or use slow scanning techniques, as the underlying communication behavior remains anomalous regardless of signature changes.
2Reliability
If traffic anomaly analysis is used to detect malware, then detection can identify unusual communication patterns, but advanced stealth worms adjust transmission rates to blend in with normal network traffic
Solution Approach 1:
The patent segments the detection approach by dividing network traffic analysis into discrete measurement periods and host communication counts. Instead of analyzing continuous traffic flow for anomalies, the system divides time into measurement periods and counts the number of unique hosts each host communicates with in each period. This segmentation transforms the detection problem into counting and threshold comparison operations, making it easier to detect stealth worms that try to blend in with normal traffic by adjusting their transmission rates.
3Productivity
If distributed scanning malware is monitored by tracking individual host communications, then each infected host scans only a small number of neighbor hosts, but the overall detection coverage becomes fragmented and less effective
Solution Approach 1:
The patent merges individual host communication data into aggregate network-wide statistics. By collecting communication count data from all hosts and calculating average communication rates across the network, the system establishes a baseline for normal behavior. This merging approach enables effective detection of distributed scanning malware, as even though each infected host only scans a small number of neighbors, the aggregate statistical analysis reveals anomalous patterns that indicate coordinated distributed scanning activity across multiple hosts.
Data Source
AI summary
Malware detection systems are presented in which a list is constructed of enterprise hosts to or from which each given enterprise network host sends or receives packets within a current measurement period and statistics are accumulated based on two or more measurement period lists, with a count value being derived from the statistics to indicate the number of other hosts to or from which each monitored host sent or received packets, and one or more monitored hosts may be identified as suspected of being infected with slow and/or distributed scanning malware for which the count value exceeds a threshold value.