Network Traffic Classification for Attack Infrastructure Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems lack effective methods for systematically analyzing the network resources used by attackers during security incidents, relying primarily on host-based behavior analysis.
Innovation Solution
A method and system that collects network traffic data from a target host device, extracts port numbers, protocols, and textual information, and uses a predefined classification model to identify and block attack infrastructure, including resources owned by attackers or compromised by them, and updates the model dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security systems focus on analyzing attacker behavior on the user's computer, then host-based security detection is achieved, but systematic analysis of network resources used by attackers is lacking
Solution Approach 1:
The patent transitions from host-based analysis to network-based analysis by examining network traffic data, port numbers, protocols, and textual information in a new dimensional space. This allows simultaneous detection of attacker behavior and identification of attack infrastructure resources, resolving the contradiction between detection precision and analysis scope.
2Measurement precision
If manual analysis of network traffic data is performed, then detailed examination of attack infrastructure is possible, but identification speed is slow
Solution Approach 1:
The patent replaces manual mechanical analysis with an automated classification model that processes network traffic data, port numbers, protocols, and textual information automatically. This substitution maintains high identification accuracy while dramatically improving processing speed and productivity.
Solution Approach 2:
The classification model performs self-learning and automatic classification of attack infrastructure without requiring continuous manual intervention. The system autonomously identifies patterns in network data, categorizes attack resources, and blocks malicious IP addresses, enabling rapid automated response.
3Measurement precision
If comprehensive network traffic data is collected and analyzed, then complete attack infrastructure identification is achieved, but system complexity increases
Solution Approach 1:
The patent segments the complex analysis task into distinct components: collecting network traffic data, extracting port numbers, identifying protocols, analyzing textual information, and classifying attack infrastructure. This segmentation allows each component to be processed independently by the classification model, maintaining completeness while managing system complexity.
Data Source
AI summary
There is provided a method for identifying attack infrastructure, performed by a computing system. The method may comprise collecting network traffic data of a host device that is the target of a security incident, acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment, automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, wherein the attack infrastructure corresponds to resources utilized by an attacker during the security incident.