Network Access Interception for Botnet Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies are inadequate in recognizing and containing botnets, as bots often masquerade as normal web traffic and use encryption protocols, making it difficult for firewalls and intrusion prevention systems to detect and block malicious network access attempts.
Innovation Solution
A system that intercepts network access attempts, evaluates the trust status of software program files using whitelists and blacklists, and blocks untrusted files, while allowing trusted files to access the network, thereby reducing the propagation and malicious activities of botnets within infected networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls and intrusion prevention systems are used to block malicious network access attempts, then network security protection is provided, but bots can masquerade as normal web traffic and use encryption protocols to evade detection
Solution Approach 1:
Instead of trying to detect and identify malicious bot traffic by analyzing its characteristics, the system inverts the approach by assuming all traffic from untrusted software is malicious and blocks it by default. The focus shifts from detecting malware signatures to evaluating the trust status of the software generating the traffic, thereby eliminating the evasion problem where bots masquerade as normal traffic
Solution Approach 2:
The system introduces a software trust evaluation mechanism as an intermediary layer between the network access attempt and the firewall/intrusion prevention system. This intermediary evaluates the trust status of software program files using whitelists and blacklists, and only allows network access from trusted software, thereby enhancing detection capability without requiring direct analysis of encrypted or disguised traffic
2Reliability
If software trust evaluation using whitelists and blacklists is implemented, then untrusted bot files are blocked, but legitimate network activities may be disrupted
Solution Approach 1:
The system performs preliminary evaluation of software trust status before network access attempts occur. Software program files are pre-evaluated and categorized as trusted or untrusted using whitelists and blacklists. This preliminary action ensures that when legitimate software needs to access the network, it has already been authenticated and can proceed without disruption, while malicious software is blocked before it can cause harm
Solution Approach 2:
The system applies different trust evaluation criteria to different software program files based on their individual characteristics and sources. Rather than applying a blanket restriction to all software, each program file is evaluated locally against the whitelist/blacklist criteria, allowing legitimate activities from trusted sources to proceed normally while blocking only the specific untrusted files that pose threats
3Reliability
If network access attempts are intercepted and evaluated, then malicious activities are blocked, but IT overhead increases
Solution Approach 1:
The system implements self-service mechanisms where software program files essentially evaluate themselves against the whitelist and blacklist criteria. The trust evaluation process is automated and does not require manual intervention from IT personnel. The system autonomously intercepts network access attempts, evaluates the software trust status, and makes blocking decisions, thereby containing botnets while minimizing the need for ongoing IT overhead and complex manual management
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method in one example implementation includes intercepting a network access attempt on a computing device and determining a software program file associated with the network access attempt. The method also includes evaluating a first criterion to determine whether the network access attempt is permitted and blocking the network access attempt if it is not permitted. The first criterion includes a trust status of the software program file. In specific embodiments, the trust status is defined as trusted if the software program file is included in a white list of trustworthy program files and untrusted if the software program file is not included in a white list. In more specific embodiments, the method includes blocking the network access attempt if the software program file has an untrusted status. In further embodiments, an event is logged if the software program file associated with the network access attempt has an untrusted status.