ML Network Session Correlation for Malware Beaconing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious actors deploy malware in cloud computing platforms to gain illicit access, and the periodic nature of malware beaconing makes it difficult to distinguish from benign periodic activity, complicating detection and mitigation.
Innovation Solution
A network session record is analyzed using a machine learning model to identify potential malware activity, calculating correlation scores between network and process session records to generate alerts and perform mitigation operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used to identify malware beaconing activity, then detection capability is limited, but false positives increase due to inability to distinguish from benign periodic activity
Solution Approach 1:
The patent transforms the detection approach by changing from analyzing individual network packets to analyzing temporal patterns of multiple packets. The system collects network packets over time periods, extracts temporal features (inter-arrival times, frequency distributions), and compares these patterns against known malware beaconing signatures. This parameter transformation from discrete packet analysis to temporal pattern analysis enables distinction between malicious and benign periodic traffic.
Solution Approach 2:
The patent adds a temporal dimension to the detection process by analyzing packets across multiple time periods rather than in isolation. The system constructs time-series representations of network traffic, applies temporal feature extraction, and uses pattern matching across dimensions of time, frequency, and packet intervals. This multi-dimensional analysis creates a richer feature space where malware patterns become distinguishable from benign traffic.
2Measurement precision
If machine learning models are deployed to improve malware detection accuracy, then detection precision improves, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary layer between raw network packets and the machine learning model. This layer includes packet collectors that aggregate packets over time periods, feature extractors that transform packets into temporal characteristics, and pattern matchers that compare against known signatures. This intermediary processing pipeline simplifies the input to the ML model, reducing its complexity while maintaining high detection accuracy through structured feature representation.
3Speed
If real-time analysis of network traffic is performed to detect malware activity, then detection speed improves, but computational resource consumption increases
Solution Approach 1:
The patent performs preliminary actions by pre-collecting network packets over defined time periods before analysis begins. Packets are buffered and aggregated in advance, allowing the detection system to work with prepared datasets rather than processing individual packets in real-time. This preliminary data collection and aggregation reduces the computational burden during the actual detection phase, enabling faster analysis with lower resource consumption.
Data Source
AI summary
Malware activity detection for networked computing systems is described. A network session record is provided to a machine learning (ML) model configured to generate an indication of whether the provided network session record evidences malware activity. The network session record indicates network traffic activity in a time period. Responsive to an indication by the ML model, correlation scores are calculated by, for each process session record in a process session record set, calculating a correlation score indicative of a correlation between the provided network session record and the process session record. Each process session record in the process session record set corresponds to a process executed by a computing device in the time period. A determination that a correlation score indicates a corresponding process session record is indicative of the evidenced malware activity is made. Responsive to the determination, a malware activity alert is generated.