Network Attack Detection via External Communication Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods, such as signature-based detection, are ineffective in identifying customized or uniquely developed malware as they rely on predefined patterns, failing to detect novel or tailored malware attacks that exploit network communication patterns.
Innovation Solution
A detection apparatus that acquires and analyzes communication data within a network, identifying external communications, service initiations, and external connections to detect potential attacks by forming associations between transmission source and destination addresses, even if the malware does not have a predefined communication pattern.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection method is used, then detection accuracy for known malware is improved, but detection capability for customized or uniquely developed malware deteriorates
Solution Approach 1:
The patent segments the detection process into multiple stages: first identifying external communications from outside the network range, then detecting service initiation communications within the network, and finally identifying external connection requests. This multi-stage segmentation allows the system to detect attack patterns without relying on predefined malware signatures, thereby maintaining detection accuracy for known malware while gaining adaptability to detect customized or unknown malware through behavioral pattern analysis.
2Productivity
If predefined communication patterns are used for detection, then detection speed is improved, but detection effectiveness against novel malware deteriorates
Solution Approach 1:
The patent performs preliminary actions by first identifying and storing information about external communications before the actual attack occurs. When a service initiation communication is detected, the system checks whether there is a corresponding external communication in the stored information. This preliminary identification of external communication patterns enables the system to quickly detect novel malware attacks without needing predefined patterns, thus maintaining both detection speed and effectiveness against new threats.
3Measurement precision
If comprehensive communication data analysis is performed, then detection accuracy for complex attacks is improved, but system complexity increases
Solution Approach 1:
The patent applies local quality by focusing analysis on specific types of communications at specific stages of the attack process. Rather than analyzing all communication data uniformly, the system specifically identifies external communications from outside the network range, then focuses on service initiation communications within the network. This localized focus on critical communication stages maintains high detection accuracy for complex attacks while avoiding the need to analyze every piece of communication data, thereby controlling system complexity.
Data Source
AI summary
Upon acquiring first data transmitted from an outside of a predetermined range in a network, an apparatus stores, in a memory, first information including transmission source and destination addresses of the first data. Upon acquiring second data addressed to an inside of the predetermined range and indicating predetermined communication data of service initiation, the apparatus extracts the first information including as the transmission source address a source address of the second data, and stores, in the memory, second information indicating a service initiation and including a destination address of the second data, in association with the first information. When the second information including as the transmission destination address a source address of the second data is stored in the memory and a destination address of the second data coincides with the transmission source address in the first information associated with the second information, the apparatus notifies detection of an attack.