Malware Barrier Using Tree-Structured Subnet Risk Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection technologies rely on communication speed and rule updates, which are inefficient in responding to malware attacks, especially in large computer networks.
Innovation Solution
A method using a tree data structure to model subnets as dynamical systems, predicting malware infection rates and prioritizing protective actions by identifying subnets at risk, deploying protective measures to create a barrier against malware propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard malware detection technology is implemented on a per-system basis with communication between systems, then malware detection capability is provided, but the response speed is insufficient due to reliance on communication speed, rule update speed and implementation speed
Solution Approach 1:
The network is segmented into hierarchical subnets modeled by a tree data structure, with each subnet represented as a node. This segmentation allows independent analysis and protection of each subnet, enabling faster localized response to malware threats without requiring system-wide communication and coordination.
Solution Approach 2:
The system performs preliminary evaluation of malware infection risk for each subnet at predetermined points in time using dynamical systems models. By predicting future infection states and identifying subnets that will be at risk before actual infection occurs, protective actions can be taken in advance, reducing the response time when threats materialize.
2Reliability
If protective actions are performed on all devices in the network, then comprehensive protection is achieved, but the complexity and resource consumption increase significantly
Solution Approach 1:
Protective actions are applied selectively to specific subnets based on their evaluated risk levels and predicted infection states. Rather than uniformly protecting all devices, the system concentrates protective resources on subnets that are predicted to be infected or at high risk, reducing overall complexity while maintaining effective protection coverage.
Solution Approach 2:
The system continuously evaluates malware infection risk for each subnet and uses this feedback to dynamically adjust protective actions. The tree data structure enables efficient propagation of risk assessments from infected subnets to connected subnets, allowing the system to adapt protection strategies based on real-time threat patterns without requiring complex centralized coordination.
3Measurement precision
If malware detection rules are updated frequently to improve detection accuracy, then detection precision improves, but the time and resources required for rule implementation increase
Solution Approach 1:
The system uses dynamical systems models to automatically predict malware infection risk and identify subnets requiring protection, eliminating the need for manual rule updates and expert analysis. The models self-adjust based on observed infection patterns and network dynamics, providing持续 detection accuracy without the time and resource overhead of frequent rule updates.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A computer implemented method of protecting a portion of computer network from malware attack, the computer network comprising a network connected devices organised into hierarchical subnets modelled by a tree data structure in which each subnet is represented as a node in the tree, each node having a connection to parent node save for a root node, the method comprising: generating a dynamical system for each subnet in the network, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware, the dynamical systems being based on rates of transmission of the malware between all pairs of subnets; evaluating, for each subnet in the network, a measure of risk of infection for the subnet at a predetermined point in time based on the dynamical systems and associating the risk with a node in the tree corresponding to the subnet; identifying a first subset of nodes in the tree data structure for which a risk of infection is below a predetermined threshold level of risk; and identifying a second subset of nodes in the tree data structure as a subset of the first subset, the second subset comprising nodes having a connection to a node in the tree data structure having a risk of infection meeting or exceeding the predetermined threshold level of risk; performing protective actions on devices in subnets associated with each of the first subset of nodes to provide protection against the malware, prioritising devices in the subnets associated with the second subset of nodes so as to provide a barrier of subnets protected against the malware to impede the propagation of the malware to devices in subnets associated with each of the first subset of nodes.