Network Malicious Behavior Detection via Passive Mirroring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security methods struggle to detect malicious behaviors without impacting normal network traffic speed, as they often require active responses to packets, occupying resources and affecting transfer speeds.
Innovation Solution
A two-stage filtering process using a networking system with a path control module, packet characteristic extraction module, mirroring module, and packet behavior analysis module to identify and block malicious packets passively, generating mirror packets for analysis without responding to normal packets, thus minimizing impact on network speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If active response methods are used to detect malicious packets, then detection capability is improved, but network resource occupation increases and transfer speed decreases
Solution Approach 1:
The patent creates mirror packets as copies of original network packets for analysis purposes. The mirroring module generates mirror packets from suspicious packets without sending active responses, allowing security analysis on copies while leaving the original packet flow uninterrupted. This resolves the contradiction by enabling detection on copies rather than interfering with the original traffic.
Solution Approach 2:
The patent introduces a mirroring module as an intermediary that sits between packet reception and analysis. Instead of directly responding to packets (which causes resource occupation), the intermediary creates mirror copies for analysis while allowing original packets to pass through unchanged. This mediator approach maintains detection capability while avoiding the resource conflicts of direct active responses.
2Measurement precision
If entire packet content is inspected for security, then detection precision is improved, but processing time increases and network speed is affected
Solution Approach 1:
The patent segments the packet analysis process into two stages: first analyzing only header information and protocol payloads to identify suspicious packets, then creating mirror copies for more detailed analysis if needed. This segmentation allows rapid initial filtering without inspecting entire packet contents, reducing processing time while maintaining detection precision through staged analysis.
Solution Approach 2:
The patent applies partial action by initially analyzing only critical portions of packets (headers and protocol payloads) rather than entire contents. This partial inspection is sufficient to identify most malicious patterns, avoiding the time cost of complete packet inspection while maintaining effective detection. Full content analysis is reserved only for mirror packets that require deeper investigation.
Data Source
AI summary
A network malicious behavior detection method, including: checking each piece of network packet to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, marking each piece of the network packet as a suspicious network packet if the check result is true, and transferring each piece of the network packet to a target device if the check result is false; and performing a malicious behavior checking process on at least one piece of the suspicious network packet, blocking the transfer of at least one piece of the suspicious network packet to the target device if the check result is true, and enabling the transfer of at least one piece of the suspicious network packet to the target device if the check result is false.