HTTP Packet Flow Analysis for Exploit Kit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting EK attack behaviors risk infringing user privacy and consume significant processor and memory resources, leading to performance deterioration.
Innovation Solution
An attack behavior detection method that analyzes Hypertext Transfer Protocol (HTTP) packet flow data using a set of behavior detection models to identify initial probability values, which are then combined to determine a comprehensive probability value indicating the likelihood of an EK attack, without parsing script code or accessing sensitive user data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If script code is collected and parsed to detect EK attack behavior, then detection accuracy is improved, but user privacy is infringed and processor/memory resources are consumed
Solution Approach 1:
The patent extracts only the necessary HTTP packet flow data (URL, method, status code, response size) from the complete web page content, excluding private user data such as cookies, form submissions, and personal information. This selective extraction enables attack detection while preserving user privacy by processing only public network traffic metadata.
Solution Approach 2:
The patent introduces an intermediary detection system that sits between the user's browser and the web server, analyzing HTTP packet flow data without requiring the user's browser to parse full script code. This intermediary approach centralizes detection functionality, preventing local privacy infringement while maintaining detection accuracy.
2Measurement precision
If script code is parsed to detect EK attack behavior, then detection accuracy is improved, but processor and memory resources are consumed
Solution Approach 1:
The patent extracts only the necessary HTTP packet flow data (URL, method, status code, response size) from the complete web page content, excluding private user data such as cookies, form submissions, and personal information. This selective extraction enables attack detection while preserving user privacy by processing only public network traffic metadata.
Solution Approach 2:
The patent replaces the mechanical process of parsing full script code with a lighter-weight analysis of HTTP packet metadata. Instead of processing complex JavaScript and HTML content, the system analyzes structured network protocol data, significantly reducing computational and memory requirements while maintaining detection effectiveness.
3Device complexity
If conventional signature-based detection is used, then implementation simplicity is maintained, but detection accuracy deteriorates against new EK variants
Solution Approach 1:
The patent changes the detection parameters from static code signatures to dynamic HTTP packet flow characteristics. Instead of matching fixed malicious code patterns, the system analyzes runtime parameters such as request/response timing, data volume changes, and communication patterns, enabling accurate detection of new EK variants that use obfuscated or encrypted payloads.
Solution Approach 2:
The patent performs preliminary analysis of HTTP packet flow patterns during the data collection phase, identifying suspicious behaviors before full attack execution. By monitoring early-stage communication patterns and preparing detection rules in advance, the system can quickly respond to new attack variants without requiring complex real-time parsing.
Data Source
AI summary
An attack behavior detection apparatus configured to obtain Hypertext Transfer Protocol (HTTP) packet flow data from a host within a reference time period, determine a plurality of initial probability values using a plurality of behavior detection models, determine a comprehensive probability value based on the initial probability values, and determine that an exploit kit (EK) attack behavior is detected when the comprehensive probability value is greater than a preset probability threshold.