Harmony Feature Vector for Service Function Chain Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques are ineffective in identifying abnormal behavior in service function chains, as they focus on individual nodes rather than the chain as a whole, and fail to consider the sequential nature of virtual system calls in distributed chains of virtualized network functions, leading to missed detections in cloud computing environments.
Innovation Solution
The approach involves generating a harmony feature vector for service function chains by filtering data based on hierarchical levels and time-order relations, using a featurization function that calculates metrics for each level based on lower levels, allowing for the detection of malware by profiling normal behavior and identifying deviations within the chain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing malware detection techniques focus on individual nodes using QDFG analysis, then detection can be performed at node level, but the service function chain as a whole cannot be detected for abnormal behavior
Solution Approach 1:
The patent segments the service function chain into multiple hierarchical levels (individual nodes, services, and chain level), allowing detection to be performed at each level while maintaining overall chain visibility. This segmentation enables precise node-level analysis through QDFG while also capturing chain-level abnormal behavior through aggregated metrics.
Solution Approach 2:
The patent introduces a hierarchical dimension to the detection framework, moving from single-node analysis to multi-level analysis encompassing nodes, services, and the entire chain. This dimensional expansion allows simultaneous detection at multiple granularities without losing either node-level precision or chain-level context.
2Ease of operation
If traditional techniques analyze node activities independently, then individual node normalcy can be assessed, but sequential malicious activities across the chain are missed
Solution Approach 1:
The patent implements feedback mechanisms where detection results and metrics from lower hierarchical levels (nodes and services) are aggregated and fed upward to chain-level analysis. This feedback loop enables the system to detect sequential malicious activities across the chain by combining information from individual node assessments, maintaining both analytical simplicity and detection reliability.
3Quantity of substance
If QDFG metrics are calculated for each node separately, then local features can be extracted, but global malicious activities in the chain remain undetected
Solution Approach 1:
The patent merges QDFG metrics from individual nodes and services to create aggregated chain-level features. By combining local features (entropy, variance, flow proportion) with global features (closeness centrality, betweenness centrality) across multiple hierarchical levels, the system captures both detailed node characteristics and overall chain-wide malicious activities that would be invisible at the individual node level.
Data Source
AI summary
A method and apparatus are disclosed for malware detection in service function chains. In one embodiment, a method includes receiving data associated with a service function chain, the service function chain comprising a plurality of virtual components organized into a plurality of hierarchical levels and the data indicating interactions between the virtual components when processing at least one packet through the service function chain; filtering the received data based at least in part on a time-between order relation of the interactions between the virtual components and the hierarchical level of the virtual component; and generating a harmony feature vector for the service function chain by applying a featurization function on the filtered data, the harmony feature vector including metrics, the metrics calculated according to the featurization function for each hierarchical level being based at least in part on metrics calculated for at least one lower hierarchical level.