Malware Detection via Behavioral Clustering of HTTP Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware infections in computer networks are inefficient due to the lack of effective clustering techniques that can accurately identify malicious behavior patterns in HTTP traffic, leading to high false alarm rates and incomplete detection capabilities.
Innovation Solution
A network-based behavioral clustering system that executes malware samples in a controlled environment, records their HTTP traffic, and uses clustering algorithms (coarse-grain, fine-grain, and cluster merging) to extract network signatures, which are then filtered to minimize false alarms and deployed for intrusion detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection coverage is limited, but false alarm rates are high
Solution Approach 1:
The patent segments malware detection into multiple hierarchical clustering levels (coarse-grain and fine-grain clustering) that analyze different aspects of HTTP traffic behavior. This segmentation allows the system to distinguish between normal and malicious traffic patterns more accurately, reducing false alarms while maintaining high detection accuracy through multi-layered behavioral analysis.
Solution Approach 2:
The patent transforms malware detection from signature-based matching to behavioral parameter analysis by extracting and clustering HTTP traffic parameters (request frequencies, response codes, timing patterns). This parameter transformation enables the system to detect malware based on behavioral characteristics rather than static signatures, significantly reducing false alarms from legitimate traffic that doesn't match known malware patterns.
2Measurement precision
If behavioral clustering is implemented, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent divides the complex behavioral clustering process into manageable segments: HTTP traffic collection, coarse-grain clustering for initial pattern identification, fine-grain clustering for detailed analysis, and signature extraction. This segmentation reduces system complexity by breaking down the overall task into modular, independently implementable components while maintaining high detection accuracy.
Solution Approach 2:
The patent performs preliminary coarse-grain clustering on HTTP traffic data before conducting detailed fine-grain clustering. This preliminary action filters and organizes the data in advance, reducing the computational complexity of subsequent detailed analysis while preserving detection accuracy by pre-identifying potential malware patterns.
3Object-affected harmful factors
If network signatures are extracted from clustered data, then false alarms are reduced, but processing time increases
Solution Approach 1:
The patent extracts network signatures from clustered malware behavior data in advance, before actual intrusion detection is needed. This preliminary signature extraction creates a reusable library of malicious traffic patterns that can be quickly matched against live traffic, reducing false alarms while minimizing processing time during actual detection operations.
Solution Approach 2:
The patent creates simplified signature representations (copies) of complex malware behavioral patterns through clustering analysis. These signature copies capture the essential malicious characteristics in a compact form that can be rapidly compared against incoming traffic, reducing false alarms from the detailed behavioral analysis while maintaining fast processing speeds for real-time detection.
Data Source
AI summary
A computerized system and method for performing behavioral clustering of malware samples, comprising: executing malware samples in a controlled computer environment for a predetermined time to obtain Hypertext Transfer Protocol. HTTP traffic; clustering the malware samples into at least one cluster based on network behavioral information from the HTTP traffic; and extracting, using the at least one processor, network signatures from the HTTP traffic information for each cluster, the network signatures being indicative of malware infection.