Network Control Apparatus for Malicious Communication Detection

The system segments communication traffic into two categories: sampled traffic sent to outside functions for analysis, and non-sampled traffic handled locally by the communication apparatus. This segmentation allows detection accuracy to be maintained for suspicious traffic while avoiding excessive bandwidth usage by not transmitting all traffic externally.

Instead of monitoring all communication traffic, the system applies partial action by selectively sampling only a portion of traffic for external analysis. The communication apparatus independently handles non-sampled traffic, performing basic security checks locally. This partial monitoring approach reduces bandwidth consumption while maintaining effective security detection through targeted analysis of sampled packets.

The communication apparatus performs preliminary security checks and filtering on non-sampled traffic before it leaves the local network. This preliminary action ensures that obviously malicious traffic is caught locally without requiring external analysis, while suspicious traffic is identified and forwarded for deeper external analysis, thereby maintaining detection accuracy while reducing bandwidth usage.

The communication apparatus acts as an intermediary between local traffic and external analysis functions. It receives all traffic, performs initial filtering and sampling decisions, forwards only selected traffic externally, and implements control decisions based on external analysis results. This intermediary role enables the system to maintain high detection accuracy through coordinated local and external analysis while minimizing bandwidth consumption.