Network Traffic Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in effectively detecting malicious user behavior activities, as behavioral patterns associated with malware are stable and difficult to change, making it hard to distinguish from benign activities using traditional malware signatures alone.
Innovation Solution
A method involving a server that monitors network traffic, identifies subsets of user behavior activities, groups them based on types, determines detection rules by finding common activities, and uses these rules to detect malware by combining weak indicators of compromise, analogous to market-basket analysis techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional malware signatures are used for detection, then detection speed is improved, but detection accuracy deteriorates because behavioral patterns are stable and difficult to change
Solution Approach 1:
The system transitions from static malware signatures to dynamic behavioral analysis by monitoring network traffic patterns over time. It captures user behavior activities within time windows, builds behavioral profiles that adapt to changing patterns, and uses sequential analysis to detect malware based on temporal sequences of actions rather than fixed signatures.
Solution Approach 2:
The system changes the detection parameters from fixed signature matching to variable behavioral thresholds. It monitors multiple parameters including network traffic volume, frequency of specific actions, time intervals between activities, and sequences of user behaviors. These parameters are dynamically adjusted based on learned normal behavior patterns, enabling accurate detection while maintaining speed.
2Reliability
If multiple weak indicators of compromise are analyzed individually, then false positives are reduced, but detection capability deteriorates because single activities are insufficient to conclude malware existence
Solution Approach 1:
The system merges multiple weak indicators of compromise by analyzing sequences of user behavior activities together. It combines network traffic data, file system activities, registry changes, and process creations into unified behavioral profiles. By merging these indicators within temporal windows and evaluating them as coordinated sequences rather than isolated events, the system achieves both high reliability and detection capability.
Solution Approach 2:
The system performs preliminary analysis by capturing and storing user behavior activities in structured formats before final detection. It pre-processes network traffic into standardized records, pre-identifies potential indicators of compromise, and pre-builds behavioral baselines during normal operation. This preliminary action enables efficient real-time detection without sacrificing detection capability.
3Measurement precision
If comprehensive network traffic monitoring is performed to identify malware patterns, then detection accuracy is improved, but computational burden increases
Solution Approach 1:
The system segments comprehensive network traffic monitoring into manageable time windows and behavioral categories. It divides traffic flows into discrete time intervals, segments user behaviors into specific activity types (network, file system, registry, process), and partitions analysis into baseline building and anomaly detection phases. This segmentation reduces computational burden while maintaining detection accuracy by processing data in smaller, organized units.
Solution Approach 2:
The system extracts only the most relevant features from comprehensive network traffic data for analysis. It extracts key user behavior activities such as connection attempts, data transfers, process creations, and file modifications while filtering out redundant information. By taking out only the essential indicators needed for malware detection, the system achieves high detection accuracy with reduced computational requirements.
Data Source
AI summary
A user behavior activity detection method is provided in which network traffic relating to user behavior activities in a network is monitored. Data is stored representing network traffic within a plurality of time periods, each of the time periods serving as a transaction. Subsets of the network traffic in the transactions are identified as traffic suspected of relating to certain user behavior activities. The subsets of the network traffic in the transactions are assigned into one or more groups. A determination is made of one or more detection rules for each of the one or more groups based on identifying, for each of the groups, a number of user behavior activities common to each of the subsets of the network traffic. The one or more detection rules are used to monitor future network traffic in the network to detect occurrence of the certain user behavior activities.