Malware Containment via Network Partitioning and Separator Patching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques are inadequate for automatically containing the propagation of malware in communication networks, such as cellular networks, where malware can quickly infect multiple devices through messaging systems.
Innovation Solution
A method involving the collection of communication statistics to generate a weighted graph representing communication patterns, partitioning the network to identify separator nodes, and providing security patches to these nodes to prevent malware propagation between network portions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security patches are provided to all communication nodes, then malware propagation is prevented, but network traffic and processing overhead increase
Solution Approach 1:
The communication network is partitioned into multiple portions based on communication statistics and pre-determined criteria. Separator nodes are identified to divide the network into isolated segments, allowing security patches to be targeted only at specific high-risk nodes rather than all nodes, thus reducing network management complexity while maintaining malware prevention capability
Solution Approach 2:
Security patches are selectively provided to separator nodes that connect different network portions, rather than uniformly to all nodes. This localized approach focuses security resources on critical boundary nodes that control malware propagation between partitions, improving efficiency while maintaining reliability
2Loss of time
If automatic malware containment is implemented, then response time is reduced, but system complexity increases
Solution Approach 1:
Communication statistics are collected and network partitions are pre-established based on communication patterns before malware infection occurs. When malware is detected, the pre-configured partition structure enables immediate identification of separator nodes for patching, significantly reducing response time while the complexity is managed through automated algorithms
Solution Approach 2:
The system automatically collects communication statistics, generates weighted graphs, identifies separator nodes, and distributes security patches without requiring manual intervention. This automation reduces response time significantly, while the complexity of the automated containment system is offset by eliminating the need for manual security management
Data Source
AI summary
The present invention relates to a method for containing propagation of a malware in a communication network having a plurality of communication nodes. The method steps include obtaining communication statistics from a traffic trace of the communication network, generating a weighted graph from the communication statistics to represent a communication pattern in the communication network, partitioning the weighted graph based on a pre-determined criteria into at least a first sub-graph representing a first portion of the communication network and a second sub-graph representing a second portion of the communication network, identifying a separator vertex from a plurality of vertices of the weighted graph, the separator vertex connecting the first sub-graph and the second sub-graph, the separator vertex representing a separator node of the plurality of communication nodes, and providing a security patch to the separator node for preventing propagation of the malware between the first portion of the communication network and the second portion of the communication network.