HTTP Malicious Traffic Detection Using Multi-Flow Traceback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious HTTP traffic fail to accurately identify malicious traffic due to insufficient consideration of multi-flow network behavior features, leading to inaccurate differentiation between rogue software and malware.
Innovation Solution
A method that traces back multiple pieces of traffic similar to an initial alarm traffic within a target time period, performs feature extraction on these pieces, and determines malicious traffic based on their behavior features, using policies such as IP address, user agent, and HTTP header information to enhance accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If single-flow feature analysis method is used, then detection process is simple, but accuracy of malicious traffic identification is insufficient
Solution Approach 1:
The patent transitions from single-flow analysis to multi-flow analysis by introducing a new dimension of observation. It aggregates multiple HTTP flows belonging to the same connection (identified by source IP, destination IP, source port, destination port) and performs joint analysis of their features. This dimensional expansion enables the system to capture behavioral patterns that are invisible at the single-flow level, thereby improving identification accuracy without proportionally increasing process complexity.
2Speed
If single-flow feature analysis is performed, then processing speed is fast, but ability to distinguish rogue software from malware is insufficient
Solution Approach 1:
The patent merges multiple single-flow features into a unified multi-flow feature set for joint analysis. By combining features from multiple flows (such as request frequency, response patterns, payload characteristics) that share the same connection parameters, the system creates a more comprehensive behavioral profile. This merging process maintains processing efficiency while significantly enhancing the ability to distinguish between rogue software and malware through aggregated behavioral evidence.
3Measurement precision
If multi-flow network behavior features are considered, then accuracy of malicious traffic identification is improved, but device complexity increases
Solution Approach 1:
The patent segments the detection process into distinct modular stages: flow collection (gathering multiple HTTP flows), feature extraction (extracting relevant features from each flow), feature aggregation (combining features across flows), and classification (identifying malicious traffic). This segmentation allows the system to handle multi-flow complexity in a structured, manageable way, where each module performs a specific function. The modular architecture improves identification accuracy while controlling system complexity through clear separation of concerns and reusable components.
Data Source
AI summary
A malicious traffic identification method and a related apparatus are provided. The malicious traffic identification method may include: determining a receiving time of first alarm traffic; obtaining, according to a preset policy, a plurality of pieces of second alarm traffic corresponding to the first alarm traffic within a target time period, where the target time period is a time period determined based on the receiving time, and a similarity between each of the plurality of pieces of second alarm traffic and the first alarm traffic is greater than a preset threshold; performing feature extraction on the plurality of pieces of second alarm traffic to obtain first feature information; and determining, based on the first feature information, whether the first alarm traffic is malicious traffic. According to this present disclosure, accuracy of malicious traffic identification on a live network can be improved by using a multi-flow traceback method.