Malware Beacon Detection from Periodic Message Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to identify unknown malware without prior knowledge of signatures or known communication addresses, as they rely on pattern matching and behavioral monitoring, which are not foolproof.
Innovation Solution
A malware beacon detection system analyzes message logs for periodicity and message length uniformity to identify potential malware by calculating a malware beacon risk score based on entropy and other factors, enabling automated response actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then detection accuracy for known malware is improved, but the ability to detect unknown malware deteriorates
Solution Approach 1:
The patent segments malware detection into two independent components: signature-based detection for known malware and anomaly-based detection for unknown malware. The system separately maintains signature databases and behavioral analysis mechanisms, allowing each to operate optimally without interfering with the other, thereby resolving the contradiction between detection accuracy for known malware and adaptability to unknown malware.
Solution Approach 2:
The patent merges signature-based detection and anomaly-based detection into a unified malware detection system. The combination allows the system to leverage the high accuracy of signature matching for known threats while simultaneously using behavioral analysis to detect unknown malware, thus achieving both detection accuracy and adaptability to unknown threats.
2Adaptability or versatility
If behavioral monitoring is used to detect unknown malware, then adaptability to detect new malware is improved, but reliability of detection deteriorates
Solution Approach 1:
The patent implements feedback mechanisms where detection results from both signature-based and anomaly-based methods are continuously evaluated and used to refine detection thresholds and improve reliability. The system learns from false positives and false negatives, adjusting its behavioral monitoring parameters to maintain high reliability while preserving adaptability to unknown malware.
3Productivity
If automated response actions are implemented, then productivity of malware mitigation is improved, but device complexity increases
Solution Approach 1:
The patent implements automated response actions that are pre-configured and ready to execute immediately upon malware detection. Common responses such as isolating endpoints, blocking network traffic, and terminating processes are prepared in advance, eliminating the need for complex real-time decision-making systems and manual intervention, thus improving productivity without significantly increasing device complexity.
Data Source
AI summary
A system that detects malware by analyzing message logs to identify message patterns that are periodic with similar-sized messages. These patterns may indicate malware since malware often sends beacon messages to a command-and-control system that are often periodic and of relatively similar length. The system may group message logs by the combination of source and destination and analyze each group for patterns of periodicity and message length uniformity. Entropy may be used to measure the uniformity of message lengths and message intervals, with low (or zero) entropy suggesting malware. Message intervals that repeat after several messages may be detected by testing subsequence sums for uniformity at different possible periods. Additional factors may be used to assess the risk, such as the duration of communication, and threat intelligence on the source or destination. The system may perform automated actions to eliminate or mitigate detected risks, such as blocking further communication.