Malware Detection via Behavioral Time Series Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods struggle to effectively detect malware, particularly in distributed Denial of Service (DoS) attacks, as they often rely on signature-based detection and fail to identify stealthy botnet communications that manipulate behavioral patterns to evade detection.
Innovation Solution
A system that generates time series of client-server communication characteristics, partitions them into time windows, and uses machine learning to identify behavioral similarities indicative of Command and Control (C&C) channels, feeding these insights into a malware detector to trigger mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based detection methods are used to identify malware, then detection speed is improved, but detection precision deteriorates because stealthy botnet communications can manipulate behavioral patterns to evade detection
Solution Approach 1:
The patent replaces traditional signature-based detection mechanisms with a machine learning-based behavioral analysis system. Instead of relying on predefined signatures (mechanical rule-based approach), the system uses automated machine learning models to analyze communication patterns, partition time series data, and detect malware based on behavioral characteristics. This substitution enables the system to achieve both high detection speed and high precision by automatically adapting to stealthy evasion techniques.
2Device complexity
If traditional detection methods are used, then system complexity is reduced, but detection capability deteriorates against distributed DoS attacks and botnets
Solution Approach 1:
The patent applies segmentation by partitioning time series data of client-server communications into multiple time windows. This segmentation allows the system to analyze behavioral patterns at different time scales, improving detection capability against distributed DoS attacks and botnets. The segmented approach enables the machine learning model to identify subtle behavioral changes that would be missed in aggregate analysis, thereby enhancing reliability without requiring excessive system complexity.
3Measurement precision
If behavioral pattern analysis is implemented to detect stealthy malware, then detection precision is improved, but computational complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-partitioning time series data into time windows and pre-processing communication characteristics before feeding them to the machine learning model. This preliminary structuring of data reduces the computational burden during actual detection, as the model receives pre-organized features rather than raw data. The pre-processing step maintains high detection precision while managing computational complexity efficiently.
Data Source
AI summary
In one embodiment, a device generates one or more time series of characteristics of client-server communications observed in a network for a particular client in the network. The device partitions the one or more time series into sets of time windows based on patterns present in the characteristics of the client-server communications. The device compares the characteristics of the client-server communications from the partitioned time windows to determine measures of behavioral similarity between the compared time windows. The device provides the measures of behavioral similarity between the compared time windows as input to a machine learning-based malware detector. The device causes performance of a mitigation action in the network when the machine learning-based malware detector determines that the particular client in the network is infected with malware.