Hierarchical Classification for Network Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based security algorithms fail to detect novel or polymorphic malware and zero-day attacks, as they rely on pre-existing threat signatures and cannot adapt to changing threats, leading to ineffective detection and blocking of advanced persistent network threats.
Innovation Solution
A hierarchical classification system (HCS) that analyzes network packet flows using statistical and machine learning algorithms to identify and classify threats, correlating features at different levels of granularity to detect novel security incidents, enabling faster recognition and remediation of threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based security algorithms are used to detect threats, then detection accuracy for known threats is improved, but the system fails to detect novel or polymorphic malware and zero-day attacks
Solution Approach 1:
The patent segments the threat detection process into multiple hierarchical levels: flow-level classification (analyzing individual network flows) and set-level classification (analyzing collections of flows). This segmentation allows the system to apply different analysis methods at each level, combining signature-based detection for known threats with anomaly-based detection for novel threats, thereby resolving the contradiction between detection accuracy and adaptability.
Solution Approach 2:
The patent introduces a new dimension of analysis by examining threats at multiple hierarchical levels (individual flows and sets of flows) rather than relying solely on single-dimensional signature matching. This multi-level hierarchical classification enables the system to detect threats through patterns across multiple dimensions, improving both detection accuracy for known threats and adaptability to novel threats.
2Reliability
If signature-based algorithms compare byte sequences to stored signatures, then known threats can be identified, but polymorphic malware with changing signatures cannot be detected
Solution Approach 1:
The patent implements dynamic threat detection by continuously analyzing network flows and updating classifications based on current traffic patterns rather than relying on static stored signatures. The system adapts to changing threats by performing real-time flow-level and set-level classifications, enabling reliable detection of both known and polymorphic malware through dynamic pattern recognition.
Solution Approach 2:
The patent performs preliminary classification of individual network flows before aggregating them into sets for further classification. This preliminary action at the flow level establishes a foundation for more comprehensive set-level analysis, enabling the system to reliably identify threats even when their signatures change, by building up evidence progressively through multiple classification stages.
3Measurement precision
If traditional signature-based security devices are deployed, then detection of recorded threats is effective, but response time to novel threats is insufficient
Solution Approach 1:
The patent segments threat detection into parallel processing streams at different hierarchical levels, allowing simultaneous analysis of individual flows and sets of flows. This segmentation enables the system to provide rapid preliminary assessments at the flow level while conducting more comprehensive set-level analysis, reducing overall response time without sacrificing detection precision for either known or novel threats.
Solution Approach 2:
The patent applies partial classification actions at the flow level that can quickly identify obvious threats, while reserving more resource-intensive set-level classification for cases requiring deeper analysis. This partial action approach enables fast response to apparent threats while maintaining the capability for thorough analysis when needed, effectively balancing response time and detection precision.
Data Source
AI summary
A system and a method are disclosed for identifying network threats based on hierarchical classification. The system receives packet flows from a data network and determines flow features for the received packet flows based on data from the packet flows. The system also classifies each packet flow into a flow class based on flow features of the packet flow. Based on a criterion, the system selects packet flows from the received packet flows and places the selected packet flows into an event set that represents an event on the network. The system determines event set features for the event set based on the flow features of the selected packet flows. The system then classifies the event set into a set class based on the determined event set features. Based on the set class, the computer system may report a threat incident on an internetworking device that originated the selected packet flows.