Malware Infrastructure Detection Using Traffic-Route Decision Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems fail to analyze traffic routes and do not account for historical or planned cybercriminal infrastructure, limiting their effectiveness in detecting current and future malicious activities.
Innovation Solution
A computer-implementable method and system that analyzes statistical relationships between infrastructure elements like IP addresses, domain names, and servers to detect malware or cybercriminal infrastructure by building decision rules based on these relationships, enabling detection of both active and dormant elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing malware detection systems use traditional traffic monitoring and WHOIS services, then they can detect known malicious nodes, but they fail to analyze traffic routes and cannot detect dormant or future malicious infrastructure
Solution Approach 1:
The system performs preliminary actions by analyzing traffic routes and building decision rules in advance that can detect not only current but also future malicious infrastructure. The decision rules are constructed beforehand to identify patterns that will indicate malicious activity, allowing the system to proactively detect threats before they fully manifest or before criminals can switch to new infrastructure.
Solution Approach 2:
The invention adds a new dimension to malware detection by analyzing traffic routes and statistical relationships between infrastructure elements, rather than relying solely on traditional WHOIS services and known malicious node databases. This dimensional change enables detection of dormant and future malicious infrastructure that traditional methods cannot identify.
2Reliability
If the system analyzes statistical relationships between infrastructure elements to detect malicious patterns, then it can identify current and potential malicious infrastructure, but the complexity of the detection system increases
Solution Approach 1:
The detection system is segmented into distinct functional modules: traffic route analysis module, statistical relationship analysis module, and decision rule construction module. Each module performs a specific function in the detection pipeline, making the overall complex system manageable and maintainable while achieving high detection reliability through coordinated operation of these specialized components.
Solution Approach 2:
The system introduces decision rules as an intermediary between raw traffic data and detection conclusions. These rules serve as a mediator that translates complex statistical relationships into actionable detection criteria, reducing the apparent complexity of the system while maintaining high detection reliability through structured rule-based reasoning.
3Adaptability or versatility
If the system uses decision rules based on statistical relationships to detect malicious infrastructure, then it can detect infrastructure that is currently active, dormant, or planned by criminals, but the computational resources required increase
Solution Approach 1:
The system applies partial action by focusing computational resources on analyzing only the most relevant statistical relationships and traffic patterns that are indicative of malicious infrastructure. Rather than exhaustively analyzing all possible infrastructure elements, the system selectively applies decision rules to high-priority targets, achieving broad detection coverage with optimized resource consumption.
Data Source
Figure 1
Figure 2
AI summary
This technical solution relates to a method and a system for malware or cybercriminal infrastructure detection. The computer-implementable method for malware or cybercriminal infrastructure detection includes receiving a request comprising at least one infrastructure element and a tag that this element belongs to a malware or cybercriminal; extracting from a database at least one parameter of the infrastructure element, at least one additional infrastructure element that is used by the same malware or cybercriminal as the obtained infrastructure element, and at least one parameter of at least one additional infrastructure element; analyzing the obtained at least one infrastructure element and at least one related parameter, and the additional infrastructure element and at least one related parameter; detecting, based on the analysis, statistical relationships between at least one parameter of at least one obtained infrastructure element and at least one parameter of at least one additional infrastructure element; creating rules of searching new infrastructure elements based on the detected statistical relationship; extracting new infrastructure elements from the database using the created rule; assigning tags corresponding to specific malwares or cybercriminals to the new elements, and storing the results in the database.