Network Malware Detection via Datagram Length and Interval Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious applications and malware in computer networks are inadequate, as they fail to effectively classify and identify potentially harmful information flowing across networks, especially in complex and large-scale environments.
Innovation Solution
The implementation of a system that monitors and analyzes datagram lengths and times across network flows, using network infrastructure devices to determine datagram lengths and duration values, which are then sent to a collector device for analysis to identify malicious applications through machine learning techniques and classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection capability is limited, but system complexity and resource consumption increase
Solution Approach 1:
The patent extracts and analyzes specific characteristics (datagram lengths and time intervals) from network flows to identify malicious applications. Instead of analyzing entire network packets or implementing complex signature matching, the system extracts only the essential temporal and size-based features, significantly reducing computational complexity while maintaining detection effectiveness
Solution Approach 2:
The patent replaces traditional mechanical analysis methods (packet inspection, signature matching, heuristic analysis) with a statistical approach based on datagram length and time interval analysis. This substitution enables automated, scalable detection without requiring complex rule engines or machine learning models, thereby reducing system complexity
2Measurement precision
If comprehensive network traffic analysis is performed, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system extracts only two critical features from each network flow: datagram lengths and time intervals between datagrams. This selective extraction avoids the computational burden of analyzing complete packet contents, headers, or performing deep protocol inspection, thereby maintaining high detection accuracy with minimal processing time
Solution Approach 2:
The patent applies partial action by analyzing only the essential temporal and size characteristics of network flows rather than performing exhaustive traffic analysis. This approach provides sufficient information for accurate malware identification without the excessive computational resources required for comprehensive packet inspection
3Measurement precision
If detailed packet inspection is performed, then detection precision increases, but network performance degradation increases
Solution Approach 1:
The system extracts minimal necessary information (datagram lengths and time intervals) from network flows without performing detailed packet inspection. This lightweight extraction process imposes negligible overhead on network throughput while achieving accurate malicious application detection through statistical analysis of these simple features
Data Source
AI summary
A method comprises receiving, at a network infrastructure device, a flow of packets, determining, using the network infrastructure device and for a first subset of the packets, that the first subset corresponds to a first datagram and determining a first length of the first datagram, determining, using the network infrastructure device and for a second subset of the packets, that the second subset corresponds to a second datagram that was received after the first datagram, and determining a second length of the second datagram, determining, using the network infrastructure device, a duration value between a first arrival time of the first datagram and a second arrival time of the second datagram, sending, to a collector device that is separate from the network infrastructure device, the first length, the second length, and the duration value for analysis.