Network Monitoring Head Packet Size Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for quickly determining the success or failure of remote control operations in network systems, particularly in cases where malware attempts to remotely control target computers, leading to potential expanded damage and increased data security risks.
Innovation Solution
An information processing apparatus that captures packets in a network, specifies the head packet for remote control responses, extracts the total size of the response, calculates the assigned area size, and determines the success or failure of remote control based on these parameters, allowing for quicker identification of successful or failed operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If current monitoring methods are used to detect remote control operations, then security monitoring coverage is maintained, but the time required to determine success or failure of remote control operations is excessive
Solution Approach 1:
The patent extracts and analyzes only the critical head packet containing remote control response information, rather than processing entire communication sequences. This extraction approach isolates the key determination element (head packet with response size information) from the complete packet stream, enabling rapid success/failure determination without analyzing all network traffic.
Solution Approach 2:
The patent changes the monitoring parameter from analyzing complete communication sequences to measuring packet size parameters, specifically the total size versus assigned area size in the head packet. This parameter transformation enables deterministic judgment of remote control success based on size relationships, dramatically reducing analysis time compared to content-based monitoring.
2Measurement precision
If detailed packet analysis is performed to accurately determine remote control outcomes, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent applies local quality by focusing analysis exclusively on the head packet's size parameters rather than examining the entire packet structure or communication content. This localized approach to the head packet's total size and assigned area size provides sufficient precision for success determination while avoiding the complexity of comprehensive packet analysis.
Solution Approach 2:
The patent transforms the measurement approach from content-based analysis to size-parameter-based analysis. By comparing the total packet size against the assigned area size in the head packet, the system achieves accurate remote control outcome determination using simple numerical comparisons rather than complex protocol interpretation.
3Reliability
If comprehensive network monitoring is implemented to detect all remote control attempts, then security coverage is improved, but processing time and system resources increase
Solution Approach 1:
The patent extracts only the essential head packet information required for remote control success determination, filtering out unnecessary packet data. This extraction maintains security monitoring coverage by identifying all remote control attempts while improving processing efficiency by analyzing only the critical size parameters in the head packet rather than complete packet contents.
Solution Approach 2:
The patent performs partial action by analyzing only the necessary head packet size parameters rather than conducting exhaustive analysis of all packet elements. This partial monitoring approach maintains sufficient security coverage for remote control detection while significantly reducing processing overhead and improving system productivity.
Data Source
AI summary
An information processing apparatus includes: a memory; and a processor coupled to the memory and configured to: specify, from among packets which are captured in a network, a head packet for transmitting a response related to remote control; extract a total size of the response from the head packet; calculate an area size which is assigned for the response in the head packet; and determine, based on the total size and the area size, that the remote control succeeds.