Network Malware Detection via Segmented Signature and Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network-based content inspection (NBCI) methods struggle to detect zero-day malware effectively due to limitations in signature-based detection and the computational intensity of behavioral-based analysis, especially at high network bandwidths, leading to inefficiencies and increased costs.
Innovation Solution
A multi-staged scanning approach combining signature-based scanning with AI-based risk assessment and behavioral analysis, utilizing parallel processing and machine learning to identify and block threats at line rates, while minimizing resource exhaustion and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If behavioral-based sandboxing techniques are used to detect zero-day malware, then detection accuracy is improved, but processing speed deteriorates and cannot maintain network line rates
Solution Approach 1:
The patent segments the malware detection process into two distinct stages: a fast signature-based filtering stage that handles known threats at line rate, and a slower behavioral analysis stage that processes only suspicious unknown content. This segmentation allows the system to maintain high processing speeds for the majority of traffic while applying thorough behavioral analysis only where needed, thus resolving the contradiction between detection accuracy and processing speed.
2Productivity
If signature-based scanning is used to detect known malware, then processing speed is improved, but detection capability deteriorates for zero-day malware
Solution Approach 1:
The patent applies preliminary signature-based filtering to quickly identify and block known malware before behavioral analysis is performed. This preliminary action handles the bulk of threats efficiently, allowing the system to maintain high scanning speeds while still preparing to detect zero-day malware through subsequent behavioral analysis of content that passes the signature filter.
3Reliability
If thorough behavioral analysis is performed on all network content, then malware detection reliability is improved, but computational resource consumption increases
Solution Approach 1:
The patent applies partial behavioral analysis only to content that is suspected of being malware based on signature filtering results, rather than performing thorough behavioral analysis on all network content. This partial action approach maintains detection reliability for suspicious content while significantly reducing overall computational resource consumption by excluding clearly benign content from intensive analysis.
Data Source
AI summary
A network-based line-rate method and apparatus for detecting and managing potential malware utilizing a black list of possible malware to scan content and detect potential malware content based upon characteristics that match the preliminary signature. The undetected content is then subjected to an inference-based processes and methods to determine whether the undetected content is safe for release. Typical to inference-based processes and method, the verdict is a numerical value within a predetermined range, out of which content is not safe. The network content released if the verdict is within safe range, otherwise, the apparatus provides various options of handling such presumably unsafe content; options including, soliciting user input whether to release, block, or subject the content to further offline behavioral analysis.