Network Threat Prevention via Traffic Monitoring and Crawler Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing network threats, such as computer viruses, spyware, and malware, are ineffective in real-time and fail to address active threats, particularly in identifying and blocking sources of known threats within dynamic web environments.
Innovation Solution
A system and method that employs a network traffic monitor, crawler, and analyzer within a service provider's infrastructure to identify and classify files based on their behavior, distinguishing between threats and non-threats by analyzing real-time network activity and updating classifications periodically, with a focus on proactive threat prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a database of known virus-related Web sites is used to block threats, then some level of protection is provided, but the method is slow and does not address active threats
Solution Approach 1:
The system performs preliminary actions by proactively monitoring and analyzing Web sites that are known to proliferate threats, before new threats are deployed. The crawler continuously scans these domains and the analyzer pre-identifies new threat files, so that when a threat is actively distributed, it is already detected and blocked. This shifts from reactive blocking to proactive prevention.
Solution Approach 2:
The system implements feedback by continuously monitoring network traffic for files matching known threat patterns, then using the crawler to investigate the source domains. The analyzer examines new files found on these domains and feeds back updated threat intelligence to the blocking system, creating a closed-loop that continuously improves detection capability and response speed.
2Reliability
If Web pages are constantly monitored to identify new threats, then active threats can be detected, but the complexity of the system increases
Solution Approach 1:
Instead of monitoring all Web pages uniformly, the system applies local quality by concentrating monitoring resources on specific domains known to proliferate threats. The crawler targets these high-risk domains preferentially, and the analyzer focuses its computational resources on files from these domains, achieving effective active threat detection without requiring system-wide complexity.
Solution Approach 2:
The system segments the monitoring task into distinct functional components: the network traffic monitor identifies suspicious files, the crawler investigates specific source domains, and the analyzer examines new files. This segmentation allows each component to be optimized independently and reduces overall system complexity by dividing the monolithic monitoring task into manageable, specialized modules.
3Measurement precision
If all files on threat domains are analyzed, then new threats are identified, but the time and computational resources required increase significantly
Solution Approach 1:
The system applies partial action by analyzing only the most relevant files on threat domains - specifically new files and files that match known threat patterns identified by the network traffic monitor. Rather than exhaustively analyzing every file on every monitored domain, the system focuses computational resources on the subset of files most likely to contain new threats, achieving high identification accuracy with reduced time and resource consumption.
Data Source
AI summary
Systems and methods responsive to communicated network threats are disclosed. An example method includes assembling a collection of files, inserting a network traffic monitor that identifies a first domain responsible for communicating a known threat, searching for and classifying files not in the collection of files, and updating the collection of files when the classification indicates that the file not in the collection of files is a network threat. An embodiment of a system includes a network traffic monitor, a crawler, a data store, and an analyzer. The network traffic monitor identifies a first domain responsible for communicating a threat. The crawler traverses the first domain and additional domains linked via the first domain. In addition, the crawler identifies changed files. The data store holds a collection of files associated with known threats and files not associated with threats. The analyzer examines and classifies new files and changed files.