Lockstep Detection and Co-occurrence Graph for Malicious Beaconing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber security systems face challenges in accurately detecting malicious beaconing activities due to high false positive rates, as they struggle to distinguish between benign and malicious network behaviors, particularly in Advanced Persistent Threats (APTs), where regular beaconing can resemble legitimate activities.
Innovation Solution
The implementation of a dual-processing method using bipartite graph data and community detection mechanisms, where the first process detects synchronized attacks through lockstep detection and the second process converts data into co-occurrence graph format to analyze communication patterns with external destination servers, employing community detection to distinguish malicious from benign activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional beaconing detection methods are used, then detection coverage is achieved, but false positive rate increases due to inability to distinguish benign from malicious activities
Solution Approach 1:
The patent segments the beaconing detection problem into two distinct processing paths: lockstep detection for synchronized attacks and co-occurrence graph analysis for community-based detection. This segmentation allows each method to specialize in detecting specific attack patterns, improving overall accuracy while reducing false positives from indiscriminate detection.
Solution Approach 2:
The patent introduces co-occurrence graphs as an intermediary data structure that captures communication patterns between devices and external servers. This intermediary representation enables the system to analyze behavioral contexts and distinguish malicious beaconing from legitimate activities by examining communication communities and patterns.
2Measurement precision
If comprehensive beaconing analysis is performed on all network traffic, then detection coverage is improved, but system complexity and processing overhead increase
Solution Approach 1:
The detection system is divided into two independent but complementary processing streams: lockstep detection for time-synchronized attacks and co-occurrence graph analysis for community-based detection. This segmentation reduces the complexity of any single detection module while maintaining comprehensive detection coverage through the combination of both approaches.
Solution Approach 2:
The patent applies partial action by focusing detection resources on specific attack patterns: lockstep detection targets synchronized beaconing, while co-occurrence graphs target community-based malicious activities. This selective approach reduces overall system complexity compared to analyzing all possible beaconing patterns uniformly.
3Productivity
If single-method beaconing detection is used, then processing speed is maintained, but detection completeness decreases due to inability to detect diverse attack patterns
Solution Approach 1:
The patent segments detection into two parallel processing methods that can operate independently and concurrently. Lockstep detection processes time-synchronized patterns while co-occurrence graph analysis processes community-based patterns, allowing the system to maintain high processing speeds while achieving comprehensive detection coverage.
Solution Approach 2:
The dual-processing framework provides multi-functionality by detecting multiple types of malicious beaconing activities (synchronized attacks and community-based attacks) within a unified system architecture. This allows the system to maintain processing efficiency while expanding detection capabilities across diverse attack patterns.
Data Source
AI summary
A cloud based implemented method (and apparatus) includes receiving input data including bipartite graph data in a format of source MAC (Media Access Control) address data versus destination IP (Internet Protocol) data and timestamp information, and providing the input bipartite graph data into a first processing to detect malicious beaconing activities using a lockstep detection module on the input bipartite graph data, as executed in a cloud environment, to detect possible synchronized attacks against a targeted infrastructure.