Network Traffic Content Stream Analysis for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus systems are vulnerable to virus attacks until all hosts in a network are updated with the latest anti-virus software, and existing application-level anti-virus programs require significant computing resources, leading to inefficiencies in detecting and managing network content.
Innovation Solution
A method for processing network traffic content involves receiving a content stream with an operation code and operand, building new streams by adding or removing data, creating models, and using cyclic redundancy check and bit tables to detect malicious content, employing filtering, CPRL, and heuristic modules to efficiently screen and verify network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application-level anti-virus programs are used to detect viruses, then virus detection capability is improved, but computing resources and processing time are significantly increased
Solution Approach 1:
The patent segments the anti-virus detection process into multiple layers: network-level filtering using signature matching and heuristics, and application-level scanning only for suspicious content. This segmentation allows most traffic to be processed with minimal resources while maintaining comprehensive detection capability.
Solution Approach 2:
The system performs partial anti-virus scanning at the network level by extracting and scanning only specific portions of network traffic (headers, signatures, heuristics) rather than complete application-level scanning of all content. This partial action reduces computing resources while maintaining detection effectiveness.
2Reliability
If complete application-level virus scanning is performed, then virus detection accuracy is improved, but network throughput and processing speed are reduced
Solution Approach 1:
The system performs preliminary filtering and scanning at the network level using signatures, heuristics, and content inspection before traffic reaches application-level scanners. This preliminary action identifies and handles obvious threats early, allowing network throughput to remain high while maintaining detection accuracy for suspicious content.
Solution Approach 2:
The patent applies different scanning intensities to different types of network traffic based on risk assessment. High-risk traffic receives complete application-level scanning while low-risk traffic receives minimal network-level filtering, optimizing both detection accuracy and network throughput for different content types.
3Reliability
If network traffic is filtered and scanned at application-level, then security detection capability is improved, but processing time and computational overhead are increased
Solution Approach 1:
The anti-virus system is segmented into network-level components (signatures, heuristics, content inspection) and application-level components. This segmentation allows parallel processing where network-level filtering operates independently and quickly, reducing overall processing time while maintaining security detection capability.
Solution Approach 2:
The system skips application-level scanning for traffic that passes network-level filters without suspicion, rushing it through to minimize processing time. Only traffic that triggers alerts or matches suspicious patterns undergoes time-consuming application-level analysis, optimizing the balance between security and processing speed.
Data Source
AI summary
A method for processing network traffic content includes receiving a content stream having an operation code and an operand, and building a new stream by either adding data to the operation code or removing the operand from the content stream. A method for processing network traffic content includes receiving a content stream, the content stream having an operation code and an operand, building a new stream by either adding data to the operation code or removing the operand from the content stream, creating a first model using at least a portion of the new stream, and searching a first cyclic redundancy check table to determine if the first model matches with a cyclic redundancy check element stored in the first cyclic redundancy check table.