Network Pathway Graph Analysis for Malicious Host Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems are ineffective in preventing malicious software spread through computer networks, particularly due to 'Man in the Middle' attacks and DNS cache attacks, which can redirect users to malicious websites or steal account information, and they often require gathering statistics before detecting attacks, leading to delayed response.
Innovation Solution
An automated method and system that explore network pathways to detect suspicious hosts by forming graphs of network topology, comparing connector prevalence against a threshold, and applying access restrictions to block malicious activity, thereby preventing attacks before data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistics gathering is used to detect attacks, then detection capability is improved, but response time deteriorates due to delayed detection after sufficient statistics are gathered
Solution Approach 1:
The system performs preliminary exploration of network pathways and builds topology graphs in advance, before attacks occur. By pre-mapping the network structure and identifying legitimate pathways, the system can immediately compare actual traffic against this baseline, enabling instant detection of deviations without needing to gather statistical data during an attack.
Solution Approach 2:
The system prepares protective measures in advance by establishing a baseline model of normal network behavior and pathways. This pre-prepared knowledge structure acts as a cushion that allows the system to immediately absorb and respond to attacks without the delay of real-time statistical analysis.
2Measurement precision
If known attack types are targeted, then detection accuracy is improved, but adaptability to new attacks deteriorates
Solution Approach 1:
Instead of detecting attacks by looking for known malicious patterns, the system inverts the approach by first establishing what legitimate network pathways look like, then detecting anything that deviates from this baseline. This inversion allows the system to identify unknown attack types by their deviation from normal behavior rather than requiring knowledge of specific attack signatures.
Solution Approach 2:
The system changes the detection parameter from 'matching known attack patterns' to 'deviation from established baseline'. By monitoring changes in pathway usage patterns, connector prevalence, and traffic flow against the pre-established model, the system can detect both known and unknown attacks through parameter deviations rather than pattern matching.
3Loss of information
If network exploration is performed, then pathway knowledge is improved, but system complexity increases due to graph formation and analysis
Solution Approach 1:
The system performs self-exploration of the network using automated agents that traverse pathways and automatically build topology graphs without external intervention. The exploration process is self-organizing, with agents autonomously discovering network structure, identifying connectors, and constructing the baseline model, thereby reducing the need for complex external configuration and management.
Data Source
AI summary
System and method for detecting malicious activity in a computer network that includes hosts and connectors between the hosts. Network pathways to a plurality of investigated hosts are explored. A graph is formed based on results of the exploring of the network pathways. The graph represents topology of explored portions of the computer network, including connectors (e.g., communication links) between the investigated hosts and intermediary hosts situated along explored pathways that include the investigated hosts, and an indication of a prevalence of connectors in pathways to each of the investigated hosts. The prevalence of connectors along pathways to each of the investigated hosts is compared against a threshold, and any suspicious host situated along pathways to a common investigated host that is associated with a connector having a low prevalence that is below the prevalence threshold is identified. An access restriction can be associated with the suspicious host.