IoT Malicious Activity Detection via Aggregated Connection Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid growth of IoT devices has made it challenging to detect malicious activities, such as DDoS attacks, as these devices can be commandeered to launch attacks, making it difficult to identify infected or compromised devices quickly.
Innovation Solution
A method and system that aggregate connection information from multiple IoT devices to determine if a requested connection is part of a larger attack by identifying a predetermined percentage of devices connecting to a destination within a specific time window, allowing for real-time blocking of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If connection requests from multiple IoT devices are aggregated and analyzed in real-time to detect attacks, then detection speed and accuracy improve, but system complexity and processing requirements increase
Solution Approach 1:
The system segments the detection process into distinct functional modules: connection request reception, aggregation of connection information from multiple devices, analysis of aggregated data to identify attack patterns, and generation of detection results. This modular segmentation allows each component to be optimized independently while maintaining overall system accuracy.
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between individual IoT devices and the detection system. This intermediary aggregates connection information from multiple devices, normalizes the data, and performs pattern recognition. This intermediary structure reduces the complexity burden on individual devices while improving collective detection accuracy.
2Reliability
If connection information from multiple user devices is aggregated and analyzed, then the ability to detect distributed attacks improves, but the time and computational resources required increase
Solution Approach 1:
The system performs preliminary actions by pre-establishing aggregation rules, pre-defining attack patterns, and pre-configuring analysis algorithms. Connection information from multiple devices is continuously aggregated in real-time using pre-defined criteria, so when an attack occurs, the system can quickly match incoming data against pre-established patterns without requiring complex real-time computation.
Solution Approach 2:
The patent employs parameter changes by dynamically adjusting aggregation thresholds, time windows, and analysis depth based on network conditions and detected attack patterns. This allows the system to maintain high detection reliability while adapting computational resource usage to match actual threat levels, reducing unnecessary processing time during normal operations.
Data Source
AI summary
Methods, systems, and media for detecting malicious activity from user devices are provided. In some embodiments, a method for detecting malicious activity from user devices is provided, the method comprising: receiving information indicating a requested connection to a destination by a first user device; adding the received information to information received from a plurality of user devices to generate aggregated connection information; determining that the requested connection to the destination by the first user device is part of an attack, wherein determining that the requested connection to the destination by the first user device is part of the attack on the destination comprises determining that more than a predetermined percentage of user devices have requested connections to the destination; receiving information indicating a requested connection to the destination by a second user device; and causing the connection to the destination by the second user device to be blocked.