Network Malware Detection via Behavioral Anomaly Counting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security mechanisms are ineffective in identifying and preventing advanced persistent threats (APTs) and malware in computer networks, as they often rely on signature matching and sandboxing, which can be circumvented by malware, leading to prolonged undetected attacks and data breaches.
Innovation Solution
A method and device for identifying safe URIs through whitelisting, where a browsing session is built by adding accessed URIs, increasing reputation scores, and validating sessions to identify safe resources, and detecting anomalies to identify infected network nodes by counting indicator events and applying infection rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching or pattern matching is used to identify malware, then malware detection capability is improved, but the system cannot detect advanced persistent threats that use obfuscated or modified signatures
Solution Approach 1:
The patent changes the detection parameters from static signature matching to dynamic behavioral analysis. Instead of matching fixed malware signatures, the system monitors multiple parameters of network traffic and node behavior (communication patterns, data flow, timing) to detect malware regardless of signature obfuscation.
Solution Approach 2:
The patent replaces the mechanical signature matching system with a behavioral analysis system that observes and analyzes the dynamic behavior of network nodes. This substitution allows detection based on operational patterns rather than static code signatures, effectively detecting obfuscated and persistent threats.
2Measurement precision
If sandboxing is used to execute suspicious code, then malware behavior analysis is improved, but network data access is blocked and data transmission rate is reduced
Solution Approach 1:
The patent extracts the behavioral analysis function from the sandbox environment and applies it directly to network traffic monitoring. Instead of isolating code execution in a sandbox, the system analyzes behavioral patterns in the actual network traffic, maintaining productivity while achieving detection accuracy.
Solution Approach 2:
The patent introduces behavioral analysis as an intermediary layer between network traffic and security decisions. Rather than blocking traffic for sandbox execution, the system uses behavioral patterns as a mediator to identify threats while allowing normal data transmission to continue.
3Reliability
If sandboxing is used to execute all HTTP requests, then malware detection is improved, but the rate at which data is provided to network nodes is greatly reduced
Solution Approach 1:
The patent applies partial action by using behavioral analysis only for suspicious or unknown traffic patterns rather than executing all HTTP requests through sandboxing. This selective approach maintains reliability for threat detection while minimizing impact on normal data delivery timing.
Solution Approach 2:
The patent performs preliminary behavioral analysis on network traffic to identify suspicious patterns before they can cause harm. This preliminary detection allows the system to respond to threats without requiring time-consuming sandbox execution for every data transmission.
4Measurement precision
If machine learning and behavioral analysis are used to find malware communication, then detection capability is improved, but false positives from legitimate suspicious activities increase
Solution Approach 1:
The patent applies multi-functionality by using the same behavioral analysis framework for both detection and validation purposes. The system monitors multiple behavioral dimensions simultaneously, allowing it to distinguish between legitimate suspicious activities and actual malware communication through pattern correlation.
Solution Approach 2:
The patent implements feedback mechanisms where detection results are continuously refined based on observed patterns. The system learns from legitimate traffic patterns and adjusts its detection thresholds, reducing false positives while maintaining detection accuracy through iterative improvement.
Data Source
AI summary
A device and a method for identifying whether a network node is infected by malware, including identifying indicator events for each of a plurality of anomaly indicators, by counting the number of occurrences of an anomaly indicator in at least one of a network node and an entire network during a predetermined time duration and if the number of occurrences of the anomaly indicator during the predetermined time duration is greater than a predetermined event threshold, identifying an indicator event associated with the anomaly indicator during the predetermined time duration and assigning an expiration duration for the indicator event, determining whether the identified indicator events fulfill at least one predetermined infection rule, and if the indicator events fulfill the at least one predetermined infection rule, identifying the network node as infected by malware.