Network Device Malware Detection via Traffic Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems for network devices, such as routers and firewalls, are inadequate in identifying stealth malware that can spoof data and evade detection by conforming to standard protocols, making it difficult to determine if these devices are compromised, especially since they cannot run third-party security software.
Innovation Solution
A system that compares inbound and outbound network traffic using network taps and a monitor server to detect unauthorized packets and modified payloads, generating alerts for packets without corresponding entering packets and violating configuration rules, and utilizes known network traffic reports from host computers to identify stealth traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based intrusion detection systems are used to detect malware on network devices, then detection capability is improved for known threats, but detection precision deteriorates for novel or stealth malware that conforms to standard protocols
Solution Approach 1:
Instead of checking if packets match known malicious signatures, the system inverts the approach by verifying that outbound packets have corresponding inbound requests. This behavioral validation method detects stealth malware that conforms to standard protocols by identifying packets that violate the normal request-response pattern, thereby resolving the contradiction between detecting known threats and detecting novel stealth threats
Solution Approach 2:
The system implements feedback by monitoring the relationship between inbound and outbound packets. It tracks whether outbound packets have corresponding inbound requests and uses this feedback information to identify potential malware infections. This continuous validation loop improves detection precision for stealth malware while maintaining reliability for known threats
2Ease of operation
If network administrators examine device settings to detect malware infections, then ease of operation is improved, but measurement precision deteriorates because advanced malware can spoof data
Solution Approach 1:
The system introduces an intermediary approach by monitoring network traffic patterns rather than directly examining device settings. The intrusion detection system acts as a mediator that validates device behavior through inbound-outbound packet correlation, preventing malware from spoofing data since the validation occurs at the network traffic level rather than relying on device-reported information
Solution Approach 2:
The system enables self-service detection by automatically monitoring and validating network traffic without requiring manual device examination. The intrusion detection system continuously correlates packets and generates alerts autonomously, improving ease of operation while maintaining high detection accuracy through automated behavioral validation
3Reliability
If third-party security software is installed on network devices to detect malware, then detection capability is improved, but device complexity increases and installation becomes difficult
Solution Approach 1:
The system uses an intermediary intrusion detection system that monitors network traffic to and from network devices without requiring installation on the devices themselves. This external monitoring approach maintains detection capability while avoiding the complexity and installation difficulties of deploying security software on closed network device systems
Solution Approach 2:
Instead of installing security software on network devices, the system creates a copy of the security monitoring function in an external intrusion detection system. The IDS replicates detection capabilities by analyzing network traffic patterns, thereby maintaining detection effectiveness without adding complexity to the network devices or requiring software installation on them
Data Source
AI summary
The present invention generally relates to detecting malicious network activity coming from network devices such as routers and firewalls. Specifically, embodiments of the present invention provide for detecting stealth malware on a network device by comparing inbound and outbound network traffic to discover packets originating from the network device and packets that violate configuration rules. When combined with a network traffic monitor server configured to monitor actual network traffic reports and to receive known network traffic reports from host computers, the system can detect stealth network traffic originating from both network devices and host computer systems.