Network File Detection via Packet Segmentation and Hash Reputation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems are ineffective in detecting and evaluating the reputation of files embedded in arbitrary locations within network flows, such as within image or PDF files, due to limitations in identifying the file's beginning and end, leading to potential malicious activity going undetected.
Innovation Solution
A method that identifies a file format identifier in network packets to parse and calculate a hash of the file, which is then sent to a reputation system for evaluation, allowing for policy actions to be taken based on the file's reputation without relying on host protocols or parsing container formats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security systems use host protocols or parse container formats to detect files, then they can identify files in standard locations, but they fail to detect files embedded in arbitrary locations within network flows
Solution Approach 1:
The patent segments the network flow into individual packets and further segments the detection process into identifying file format identifiers, parsing file structures, and calculating hashes. This segmentation allows the system to detect files embedded in arbitrary locations by processing discrete packets independently rather than requiring complete container format parsing.
Solution Approach 2:
The patent extracts the file format identifier and essential file structure information from within the network flow packets without requiring extraction from container formats. By taking out only the necessary identification elements (file headers, format identifiers) rather than parsing entire container structures, the system can detect embedded files in arbitrary locations efficiently.
2Reliability
If the system parses complete container formats to identify embedded files, then it can locate files within containers, but it increases processing complexity and time
Solution Approach 1:
The patent extracts only the essential file format identifier and minimal structure information from packets rather than parsing complete container formats. This extraction approach maintains reliable file detection by identifying key file signatures and headers while avoiding the complexity of full container format parsing.
Solution Approach 2:
The patent performs preliminary identification of file format identifiers and calculates file hashes based on parsed structure information before complete file extraction or container parsing. This preliminary action enables early detection and reputation evaluation, reducing overall processing complexity.
3Reliability
If the system evaluates reputation of all files in network flows, then it can block malicious files, but it may increase false positives and reduce system performance
Solution Approach 1:
The patent applies partial action by evaluating the reputation of only those files that are successfully identified through format identifier detection and structure parsing, rather than evaluating all files in network flows. This selective approach reduces false positives by focusing resources on files with confirmed structures while maintaining reliable malicious file detection through hash-based reputation systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is provided in one example embodiment that includes identifying a file format identifier associated with a beginning of a file, parsing the file based on the file format identifier until an end of the file is identified, and calculating a hash from the beginning of the file to the end of the file. The method may also include sending the hash to a reputation system and taking a policy action based on the hash's reputation received from the reputation system.