Invariant Detection System for Unknown Malware at High Line Rates

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current antivirus systems rely on known signatures to detect viruses and worms, making them ineffective against unknown and potentially harmful code, and they struggle to operate at high line rates while managing memory efficiently, especially in the face of increasing network threats and denial-of-service attacks.

Innovation Solution

A scalable system that detects frequent and dispersed invariants by tracking frequency rates and dispersion criteria, using a hardware-based approach that can operate at line rates exceeding 5 Gbps with significantly less memory than conventional systems, and incorporates techniques for sampling traffic streams and dynamic thresholding to counter denial-of-service attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional antivirus systems use known signatures to detect viruses and worms, then detection accuracy for known threats is improved, but effectiveness against unknown and potentially harmful code deteriorates

Engineering Contradiction:
Improvedetection accuracyVSAvoideffectiveness against unknown code
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system dynamically adapts its detection mechanism by transitioning from static signature matching to dynamic invariant tracking. It continuously monitors network traffic for dispersed invariants (patterns) and updates its detection capabilities in real-time, enabling it to identify unknown viruses and worms that do not match pre-programmed signatures.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system performs self-learning by automatically detecting and tracking invariants from network traffic without requiring manual signature creation. It builds its own detection rules through observation of network patterns, allowing it to independently identify new threats and adapt to evolving malware techniques.

Inventive Principle:
Principle #25Self-service

2Adaptability or versatility

If conventional systems track frequency and dispersion of invariants, then detection capability for unknown viruses is improved, but memory requirements and processing speed deteriorate

Engineering Contradiction:
Improvedetection capabilityVSAvoidmemory requirements
Core Design Contradiction:
Adaptability or versatilityVSQuantity of substance

Solution Approach 1:

The system segments the network traffic analysis process into distinct functional components: frequency tracking module, dispersion tracking module, and threshold evaluation module. Each component handles specific aspects of invariant analysis independently, reducing the memory footprint required to store all possible patterns while maintaining comprehensive detection capability.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system dynamically adjusts tracking parameters based on network conditions and threat patterns. It modifies frequency thresholds, dispersion criteria, and sampling rates in real-time, allowing efficient resource utilization while maintaining high detection accuracy for unknown viruses without requiring excessive memory capacity.

Inventive Principle:
Principle #35Parameter changes

3Speed

If systems operate at high line rates (e.g., 5 Gbps), then processing speed is improved, but memory management and denial-of-service vulnerability worsen

Engineering Contradiction:
Improveprocessing speedVSAvoiddenial-of-service resistance
Core Design Contradiction:
SpeedVSReliability

Solution Approach 1:

The system implements periodic sampling of network traffic rather than continuous processing. It analyzes invariants at regular intervals with adjustable sampling rates, reducing the memory burden and processing overhead while maintaining the ability to detect threats at high line rates. This periodic approach also makes the system more resilient to denial-of-service attacks by limiting the data volume processed at any given time.

Inventive Principle:
Principle #19Periodic action

4Ease of manufacture

If systems use fixed thresholds for invariant detection, then implementation simplicity is improved, but adaptability to different attack patterns and denial-of-service countermeasures deteriorates

Engineering Contradiction:
Improveimplementation simplicityVSAvoidadaptability to attack patterns
Core Design Contradiction:
Ease of manufactureVSAdaptability or versatility

Solution Approach 1:

The system replaces fixed detection thresholds with dynamic, adaptive thresholds that automatically adjust based on observed network traffic patterns and detected threats. It learns from the environment and modifies its detection criteria in real-time, maintaining ease of implementation while significantly improving adaptability to various attack patterns and denial-of-service scenarios.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentEP2033356B1Detection of frequent and dispersed invariants
Publication Date: 2015.08.12 CISCO TECHNOLOGY INC
  • EP2033356B1 patent drawingFigure 1
  • EP2033356B1 patent drawingFigure 2
  • EP2033356B1 patent drawingFigure 3

AI summary

A scalable method and apparatus that detects frequent and dispersed invariants is disclosed. More particularly, the application discloses a system that can simultaneously track frequency rates and dispersion criteria of unknown invariants, in other words, the application discloses an invariant detection system (figure 1 ) implemented in hardware (and/or software) that allows detection of invariants (e.g., byte sequences) that are highly prevalent (e.g., repeating with a high frequency) and dispersed (e.g., originating fro many sources and destined to many destinations).