Network Malicious Behavior Detection via Partial Signatures and DNS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious behavior on computer networks, such as worms using buffer overflow exploits, are inadequate as they rely on host-based signature detection, which is inefficient and prone to false positives, and fail to detect sophisticated or polymorphic viruses and zero-day attacks.
Innovation Solution
A method that performs partial signature detection by monitoring network packets for small virus code portions and combines this with DNS monitoring to identify suspicious behavior, allowing for early detection of malicious activity even before entire virus signatures are recognized.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If host-based signature detection is used to detect malicious behavior, then detection accuracy can be maintained, but detection efficiency decreases and false positives increase
Solution Approach 1:
The patent segments the detection process into two parts: network-based partial signature detection for initial identification, followed by host-based verification. This segmentation allows the system to use lighter-weight network monitoring to catch suspicious patterns without requiring full signature matching on every host, thereby improving efficiency while maintaining accuracy through the two-stage approach.
Solution Approach 2:
The patent applies partial action by performing partial signature detection on network packets rather than complete signature matching. The system detects partial matches of virus signatures in network traffic and uses this as preliminary evidence, which when combined with DNS monitoring, provides sufficient detection capability without requiring full signature verification, thus improving detection efficiency.
2Reliability
If complete virus signatures are monitored in network packets, then detection reliability improves, but detection speed decreases and processing overhead increases
Solution Approach 1:
The patent extracts only the essential partial signature elements from complete virus signatures for network monitoring. Instead of searching for entire virus signatures in network packets, the system extracts and monitors for characteristic byte sequences or partial patterns that are sufficient for identification when combined with DNS monitoring results, thereby maintaining reliability while improving detection speed.
Solution Approach 2:
The system performs partial signature matching on network packets rather than complete signature verification. This partial action approach allows the system to quickly identify suspicious traffic patterns without the computational overhead of full signature matching, achieving faster detection while maintaining reliability through the combination with DNS monitoring.
3Reliability
If traditional signature-based detection is used, then known viruses can be detected, but polymorphic viruses and zero-day attacks cannot be detected
Solution Approach 1:
The patent introduces dynamics by combining static signature matching with dynamic DNS behavior monitoring. The DNS monitoring component adapts to various attack types by analyzing query patterns, frequencies, and destinations, allowing the system to detect both known viruses through signatures and unknown/polymorphic viruses through anomalous DNS behavior patterns.
Solution Approach 2:
The patent creates a universal detection system that serves multiple functions: detecting known viruses through signature matching, detecting polymorphic viruses through partial signature and DNS analysis, and identifying zero-day attacks through anomalous DNS behavior patterns. This multi-functional approach increases adaptability while maintaining reliability for known threats.
4Productivity
If DNS monitoring alone is used to detect malicious behavior, then network-level detection capability is provided, but false positives occur frequently
Solution Approach 1:
The patent merges DNS monitoring with partial signature detection to create a combined detection system. The DNS monitoring provides network-level detection capability while the partial signature matching provides additional verification evidence. When both indicators align, the system can confidently identify malicious activity, significantly reducing false positives while maintaining high network-level detection capability.
Solution Approach 2:
The system uses feedback from multiple detection sources (DNS monitoring and partial signature matching) to verify suspicious activity. When DNS monitoring identifies potential threats, partial signature detection provides feedback to confirm or refute the suspicion, creating a verification mechanism that reduces false positives while maintaining sensitive detection capability.
Data Source
Figure 1~2
Figure 3a
Figure 3b
AI summary
A malicious behaviour detector (100) for detecting malicious behaviour on a network, comprises a processor unit (120) and associated system memory (130) containing computer program code. The computer program code provides a signature matching module (132) to perform malicious partial signature detection by reading the contents of packets of data passing through the network to look for partial signatures associated with malicious programs; a Domain Name Service, DNS, request and/or response detection module (134) to monitor the requests made by hosts connected to the network and/or responses thereto; and an evidence assessment module (138) to analyse the results of the partial signature detection and the DNS monitoring make a determination of the suspected presence of malicious behaviour on the network based upon the analysis of the results of both the partial signature detection and the DNS monitoring.