Network Traffic Similarity Detection Using Hash Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting suspicious DNS behavior in botnets are inefficient due to the high processing power required for computing similarity matrices on large datasets, making it difficult and expensive to quickly identify similarities in network traffic.
Innovation Solution
A computer-implemented method using hash functions to group IP addresses and domains, reducing data processing by creating hash signatures and pairs for similarity computation, allowing for faster and more scalable detection of similar network activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If similarity matrices are computed on large datasets to detect suspicious DNS behavior, then detection accuracy is improved, but processing power requirements increase significantly
Solution Approach 1:
The patent segments the large dataset into smaller manageable portions by grouping IP addresses and domains into pairs, then computing similarity matrices only on these segmented pairs rather than the entire large dataset at once. This reduces the processing power required for each computation step while maintaining overall detection accuracy.
Solution Approach 2:
The patent extracts only the necessary information (IP address and domain name pairs) from the large dataset and focuses similarity computation on these extracted pairs. By taking out only the essential data elements needed for detection, the system reduces processing requirements while maintaining detection effectiveness.
2Measurement precision
If similarity matrices are computed on large datasets to detect botnet behavior, then detection accuracy is improved, but computation time increases
Solution Approach 1:
The patent divides the large computation task into smaller segments by working with IP-domain pairs rather than the entire dataset simultaneously. This segmentation allows parallel processing and reduces the time required to compute similarity matrices while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent applies partial action by computing similarity matrices only for the necessary IP-domain pairs rather than all possible combinations in the large dataset. This selective computation reduces processing time while maintaining sufficient detection accuracy for identifying botnet behavior.
3Adaptability or versatility
If comprehensive similarity analysis is performed on network traffic, then detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex analysis task into manageable components by focusing on specific IP-domain pairs rather than performing comprehensive analysis on the entire network traffic dataset. This segmentation simplifies the system architecture while maintaining robust detection capability.
Solution Approach 2:
The patent extracts only the essential IP-domain pair information from complex network traffic data and performs similarity analysis on these extracted pairs. By taking out only the necessary data elements, the system reduces complexity while maintaining comprehensive detection capability for botnet identification.
Data Source
AI summary
A system, computer-readable medium, and method for identifying similarities in network traffic are provided. Hash values are calculated from Internet Protocol (IP) addresses in a group of IP addresses that request a domain name, a hash signature is generated from the hash values and paired with the domain name, and the domain name is then clustered with another domain name having a paired hash of the same value. The clustered domain names are then extracted and used in a similarity calculation.