Malicious Behavior Detector for Network File Download Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods based on blacklisting and signatures are easily bypassed by sophisticated malware distributors, making it difficult to effectively detect malicious activities in computer networks.
Innovation Solution
A method and system that analyze file download flows in a network using a malicious behavior detection algorithm to generate malicious indications, identify shared attributes among suspicious flows, and compute a malicious score to determine the level of association and initiate appropriate security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based detection methods are used, then detection simplicity is maintained, but detection effectiveness deteriorates as malware distributors become increasingly savvy in disguising their activities
Solution Approach 1:
The patent changes the detection parameters from static signatures to dynamic behavioral patterns. Instead of detecting malware based on fixed signature strings, the system monitors file download flows and analyzes behavioral parameters such as download frequency, source-destination relationships, and temporal patterns. This allows the system to adapt to disguised malware while maintaining reasonable complexity through automated algorithmic analysis.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an automated behavioral analysis system. The malicious behavior detection algorithm automatically monitors network traffic, extracts features from file download flows, and computes malicious scores without requiring manual signature updates. This substitution enables the system to handle sophisticated disguised malware while reducing operational complexity.
2Reliability
If behavioral analysis of file download flows is implemented, then detection capability is improved, but computational complexity increases
Solution Approach 1:
The patent segments the behavioral analysis into distinct modular components: flow extraction module that isolates file download flows, feature extraction module that identifies relevant attributes, malicious indication generation module that detects suspicious patterns, and malicious score calculation module that quantifies threat levels. This segmentation reduces computational complexity by processing different aspects separately rather than analyzing all traffic comprehensively at once.
Solution Approach 2:
The patent applies partial action by focusing analysis only on file download flows rather than all network traffic. The system selectively monitors downloads and applies behavioral analysis algorithms only to this specific subset of traffic, reducing overall computational complexity while maintaining effective malware detection capability for download-based threats.
3Productivity
If automated malicious score calculation is used, then analysis speed is improved, but algorithm complexity increases
Solution Approach 1:
The patent implements self-service through automated algorithms that independently perform feature extraction, malicious indication generation, and score calculation without human intervention. The system automatically processes file download flows, identifies suspicious patterns, and computes malicious scores using pre-defined algorithms, enabling high-speed automated analysis while managing complexity through algorithmic standardization.
Solution Approach 2:
The patent incorporates feedback mechanisms where malicious scores are computed based on accumulated behavioral evidence from multiple file download flows. The system continuously monitors patterns, updates malicious indications, and adjusts scores based on recurring suspicious behaviors. This feedback loop enables automated speed while managing complexity through iterative refinement rather than complex one-time analysis.
Data Source
AI summary
A method for detecting a malicious activity in a network. The method includes obtaining file download flows from the network, analyzing, the file download flows to generate malicious indications using a pre-determined malicious behavior detection algorithm, extracting a file download attribute from a suspicious file download flow of a malicious indication, wherein the file download attribute represents one or more of the URL, the FQDN, the top-level domain name, the URL path, the URL file name, and the payload of the suspicious file download flow, determining the file download attribute as being shared by at least two suspicious file download flows, identifying related suspicious file download flows and determining a level of association between based at least on the file download attribute, computing a malicious score of the suspicious file download flow based on the level of association, and presenting the malicious score to an analyst user of the network.