Malicious File Detection via Network Activity Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious file detection systems often fail to identify malicious files in real-time as they can infect client devices before detection, and existing solutions require pre-developed signatures, which may not cover newly encountered malicious files.
Innovation Solution
A security device generates a network activity profile for a malicious file in a testing environment and monitors client devices to match this profile, providing notifications when matching network activity is detected, allowing for real-time identification of infected devices without relying on pre-existing signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malicious file detection tools perform analysis on downloaded files, then detection capability is provided, but the file may execute and infect the client device before detection completes
Solution Approach 1:
The system performs preliminary analysis of the malicious file in a sandboxing environment before the file can execute on the client device. The sandboxing environment captures network activity profiles of the malicious file's attempted connections, allowing detection to occur prior to actual infection.
Solution Approach 2:
The patent introduces a sandboxing environment as an intermediary between the malicious file and the client device. This intermediary environment captures network activity profiles by intercepting and monitoring the malicious file's attempted network connections, preventing direct execution on client devices while maintaining detection capability.
2Reliability
If pre-developed signatures are used for malicious file detection, then known malicious files can be identified, but newly encountered malicious files cannot be detected
Solution Approach 1:
The system changes the detection parameters from static pre-developed signatures to dynamic network activity profiles captured during sandboxing. This allows the detection mechanism to adapt to new malicious files by observing their actual network behavior patterns rather than relying on pre-programmed signatures.
Solution Approach 2:
The sandboxing environment provides feedback about the malicious file's network activity by capturing and analyzing its attempted connections. This feedback mechanism enables the system to learn and adapt to new malicious files' behaviors, improving detection coverage without requiring pre-developed signatures for each variant.
3Productivity
If network activity monitoring is performed on client devices, then real-time detection of malicious operations is enabled, but system complexity increases
Solution Approach 1:
Instead of directly monitoring all client devices, the system creates a simplified copy of the monitoring function through sandboxing. The sandbox environment replicates the network monitoring capability in a controlled setting, capturing activity profiles that can be matched against actual client behavior without requiring complex continuous monitoring infrastructure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device may receive a trigger to determine whether a malicious file is operating on a client device. The device may determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device. The network activity profile may include information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment. The device may monitor network activity associated with the client device. The device may determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device. The device may provide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.