Network Data Timeline for Malicious Activity Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems lack an efficient method to analyze historical network data for detecting and tracking malicious activity due to the large volume of data, which requires significant storage and processing power, and often result in slow response times.
Innovation Solution
A system that collects and analyzes network data to identify malicious activity by mapping, aggregating, and tracking it to an earliest connection date, using a risk management system with modules for data collection, mapping, aggregation, detection, tracking, and risk calibration, employing machine learning models and convolutional neural networks to efficiently process and classify network port data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If historical network data is analyzed to track malicious activity, then insight into network traffic and malware behavior is improved, but storage and processing requirements increase significantly
Solution Approach 1:
The patent extracts only the essential features from raw network data - specifically source IP addresses, destination IP addresses, and timestamps - while discarding redundant information. This extraction process reduces the data volume from petabytes to a manageable size while preserving the capability to track malicious activity and analyze network behavior patterns.
Solution Approach 2:
Instead of storing all raw network data and then searching through it, the patent inverts the approach by pre-processing and indexing only the critical fields (source IP, destination IP, timestamp) into a searchable structure. This inversion allows rapid querying of historical data without requiring storage of the complete raw dataset.
2Loss of information
If historical network data is analyzed to track malicious activity, then breach tracking capability is improved, but analysis speed deteriorates due to large data volume
Solution Approach 1:
The patent performs preliminary action by pre-processing network data in advance and organizing it into an indexed structure with source IP addresses, destination IP addresses, and timestamps. This pre-organization enables rapid retrieval and analysis when security events occur, eliminating the need to scan through petabytes of raw data during incident response and thus maintaining high analysis speed.
Solution Approach 2:
The patent segments the large historical network data into discrete, indexable records containing only essential fields (source IP, destination IP, timestamp). This segmentation transforms the data into a format that can be efficiently queried and analyzed, enabling fast breach tracking without requiring access to the complete raw dataset.
3Measurement precision
If comprehensive network data is stored for historical analysis, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent extracts only the critical elements needed for malicious activity detection - source IP addresses, destination IP addresses, and timestamps - from the comprehensive network data. This selective extraction maintains detection accuracy by preserving the essential information needed to identify and track malicious patterns while eliminating unnecessary data that would increase system complexity.
Data Source
AI summary
A system and a method are disclosed for describing a mechanism for tracking malicious activity detected on a network. For example, based on network data collected from a server, the disclosed system may detect malicious activity originating from a client device directed to the server. To detect the malicious activity, network data may be captured by the server and analyzed. When malicious activity is detected, the system may track the malicious activity, using the network data, to an earliest connection date of a client device from where the malicious activity potentially originated. The earliest connection date may indicate a potential start date of the malicious activity.