Network Footprint Graph Classification for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber threat detection methods, particularly in the private sector, face challenges in efficiently identifying new threats due to high false alarm rates and the inability to accurately specify valid behaviors of malware, leading to delayed detection and inadequate protection against evolving cyber threats.
Innovation Solution
The approach involves network embedding techniques to analyze the propagation of objects in ISP traffic using machine learning, where the digital representation of software objects is derived from their network footprint, enabling the classification of objects as malicious or benign and facilitating early identification of new malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly-based malware detection approaches are used, then detection capability is provided, but false alarm rate increases significantly
Solution Approach 1:
The patent changes the detection parameters from traditional anomaly-based metrics to network footprint-based metrics. By representing malware as graphs with specific topological features (clustering coefficient, average path length, diameter) and using these transformed parameters for classification, the system achieves more accurate detection with lower false alarm rates while maintaining detection capability.
2Measurement precision
If specification-based detection is used, then detection accuracy is improved, but difficulty in specifying complete valid behaviors increases
Solution Approach 1:
Instead of trying to specify all valid malware behaviors (the traditional approach), the patent inverts the problem by detecting malware through its network footprint characteristics. By analyzing the topological structure of communication networks rather than specifying behavioral rules, the system achieves high detection accuracy without the complexity of comprehensive behavior specification.
3Loss of time
If machine learning techniques are applied to network embedding, then detection time is reduced, but computational complexity increases
Solution Approach 1:
The patent extracts key topological features from complex network data (clustering coefficient, average path length, diameter, node degree distribution) and uses these extracted features for machine learning classification. By taking out only the essential structural characteristics and discarding redundant data, the system reduces detection time while managing computational complexity through feature selection rather than processing all raw network data.
Data Source
AI summary
The present invention provides a method for determining a type of an object distributed through communication network said method implemented by one or more processing devices operatively coupled to a non-transitory storage device, on which are stored modules of instruction code that when executed cause the one or more processing devices to perform: monitoring objects traffic through communication network; building the objects' footprint, wherein said footprint is inferred from monitored traffic flows that contain said object wherein the footprint is organized in a graph structure wherein nodes are source and target network addresses of said traffic flows two nodes are connected if there is a traffic flows between the network address of the respective nodes containing the said object, analyzing the objects footprint for identifying features characteristics/parameters of the footprint to determine the objects type.