Network Risk Detection via Behavioral Profile Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for preventing malicious activity on computer networks, such as blacklisting and sandboxing, are inadequate as they fail to detect newer threats and require extensive human expertise, and do not effectively focus on behavioral analysis of network interactions.
Innovation Solution
Establishing a network history baseline with behavior profiles to detect risky communications by comparing new communications to normal and abnormal behavior patterns, assigning risk scores based on anomalies and pattern matching, and using machine learning to improve accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting methods are used to block known malicious traffic, then detection of established threats is improved, but detection of newer malicious signatures is worsened
Solution Approach 1:
The system performs preliminary actions by establishing a network history baseline from prior communications before evaluating new traffic. This baseline captures normal behavioral patterns in advance, enabling the system to detect deviations caused by new threats without requiring pre-existing signatures for them.
Solution Approach 2:
The system transitions from static blacklist matching to dynamic behavioral analysis. By continuously comparing new communications against the established baseline and updating risk scores based on behavioral normalcy, the system adapts to new threats while maintaining reliability for detecting known malicious patterns.
2Reliability
If sandboxing is used to intercept and analyze potentially malicious code, then containment of malicious effects is improved, but requirement for human expert attention is worsened
Solution Approach 1:
The system performs self-service by automatically assigning risk scores to communications based on behavioral comparisons with the network history baseline. This automated evaluation reduces the need for human expert intervention while maintaining effective identification and containment of malicious activity through the output signal mechanism.
Solution Approach 2:
The system replaces manual human analysis with an automated computational mechanism that evaluates communications against behavioral profiles. This substitution maintains the effectiveness of threat identification and containment while eliminating the operational burden of extensive human expert attention.
3Speed
If conventional signature-based methods are used, then detection speed for known threats is improved, but ability to detect behavioral anomalies is worsened
Solution Approach 1:
The system achieves multi-functionality by combining rapid signature-based detection with behavioral anomaly detection through baseline comparison. This unified approach maintains fast detection speed for known threats while simultaneously enabling precise identification of behavioral anomalies that deviate from normal patterns.
Solution Approach 2:
The system adds another dimension to threat detection by moving beyond signature matching into behavioral space. By evaluating communications against behavioral profiles and assigning risk scores based on deviations from normal patterns, the system detects anomalies that signature-based methods alone would miss.
Data Source
AI summary
A technique detects riskiness of a communication in a network based on behavior profiling. The technique involves generating a network history baseline (e.g., normal and abnormal behavior profiles) from prior network communications occurring in the network. The technique further involves, for a new network communication, assigning the new network communication a risk score based on a comparison of the new network communication to the network history baseline. The risk score is a numerical measure of behavioral normalcy relative to the prior network communications occurring in the network. The technique further involves providing an output signal having a first value when the risk score is above a predefined risk threshold to indicate that the communication is risky, and a second value which is different than the first value when the risk score is below the predefined risk threshold to indicate that the communication is not risky.