Malware Detection via Transaction Feature Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious software, particularly those using Command and Control (C&C) communication, struggle to distinguish between malicious and innocent traffic, often failing to identify disguised C&C communication within conventional protocols like HTTP, leading to high false alarms and low detection efficiency.
Innovation Solution
The method involves monitoring and analyzing fine-granularity features of request-response transactions, such as header fields and statistical properties, to identify characteristics indicative of C&C communication, using a distributed system with adaptive malware detection criteria to differentiate between malicious and innocent traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional C&C detection methods are used, then detection capability is provided, but false alarm rate increases and detection precision deteriorates
Solution Approach 1:
The patent segments the C&C detection process into multiple independent feature evaluation stages: extracting request-response transactions, evaluating individual features (URL patterns, header fields, timing characteristics), computing statistical properties for each feature, and finally aggregating results. This segmentation allows each feature to be analyzed independently, improving detection precision by reducing false alarms from any single feature while maintaining comprehensive detection capability.
Solution Approach 2:
The patent changes the parameter of detection by evaluating multiple different features simultaneously rather than relying on a single C&C indicator. Each feature (URL structure, HTTP headers, timing patterns, payload characteristics) is evaluated independently and aggregated statistically. This parameter transformation from single-indicator detection to multi-feature statistical analysis resolves the contradiction by improving precision through feature differentiation while maintaining reliable detection through comprehensive coverage.
2Measurement precision
If fine-granularity feature analysis is performed, then detection precision is improved, but system complexity increases
Solution Approach 1:
The system segments the complex analysis task into modular, independent feature evaluation components. Each feature (URL patterns, header fields, timing characteristics) is extracted and evaluated separately through dedicated processing stages. This segmentation reduces system complexity by making each component independent and manageable, while still achieving high detection precision through the collective analysis of multiple fine-granularity features.
Solution Approach 2:
The system employs adaptive malware detection criteria that automatically adjust based on observed traffic patterns without requiring manual configuration or training sets. The detection criteria self-adapt to recognize previously unknown malware by learning from the statistical properties of evaluated features. This self-service mechanism reduces operational complexity while maintaining high detection precision through automatic adaptation.
3Reliability
If multiple features are evaluated, then detection reliability is improved, but processing time increases
Solution Approach 1:
The patent implements a staged evaluation process where features are extracted and evaluated in sequence rather than all at once. The system computes statistical properties for each feature independently and aggregates results progressively. This partial action approach allows the system to maintain high detection reliability through comprehensive multi-feature analysis while reducing processing time by avoiding simultaneous computation of all features, instead processing them in an efficient sequential manner.
Data Source
AI summary
Systems and methods for malware detection techniques, which detect malware by identifying the C&C communication between the malware and the remote host. In particular, the disclosed techniques distinguish between request-response transactions that carry C&C communication and request-response transactions of innocent traffic. Individual request-response transactions may be analyzed rather than entire flows, and fine-granularity features examined within the transactions. As such, these methods and systems are highly effective in distinguishing between malware C&C communication and innocent traffic, i.e., in detecting malware with high detection probability and few false alarms.