Network Traffic Filtering Using User Activity Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security techniques struggle to detect unknown threats such as 0-day attacks and Advanced Persistent Threats (APT), relying heavily on signatures and behavior anomalies, which are insufficient for identifying malicious network traffic.
Innovation Solution
A method that analyzes user, system, and application activities to differentiate between legitimate and suspicious network events using an Event Correlation Engine based on linear temporal logic, generating correlation rules to determine what entity has triggered network events, and an Advanced Network Firewall to block unwanted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection and behavior anomaly analysis are used, then known attacks can be detected, but unknown threats such as 0-day attacks and APTs cannot be sufficiently detected
Solution Approach 1:
The system performs preliminary analysis of network traffic, user activities, system activities, and application activities before making blocking decisions. By continuously monitoring and analyzing these activities in advance, the system builds a baseline of normal behavior and can detect deviations that indicate unknown threats, rather than waiting for signature updates
Solution Approach 2:
The patent introduces a new dimension of analysis by correlating multiple types of activities (network traffic, user activities, system activities, application activities) together using linear temporal logic. This multi-dimensional correlation approach enables detection of unknown threats by identifying patterns across different activity layers that would not be visible through traditional single-layer signature-based detection
2Measurement precision
If network traffic analysis is performed to identify malicious activity, then security detection capability is improved, but the system cannot effectively distinguish between legitimate and malicious traffic without updated security rules
Solution Approach 1:
The system implements continuous feedback loops where network traffic, user activities, system activities, and application activities are constantly monitored, analyzed, and correlated. The Event Correlation Engine uses linear temporal logic to continuously evaluate the correlated data and provide feedback for real-time detection decisions, eliminating the need for manual rule updates while maintaining high detection precision
Solution Approach 2:
The Event Correlation Engine acts as an intermediary that receives and correlates data from multiple sources (network traffic analyzers, user activity loggers, system activity loggers, application activity loggers). This intermediary layer processes the raw data through linear temporal logic correlation rules, transforming complex multi-source data into actionable security decisions without requiring external rule updates
3Reliability
If correlation rules are manually created and updated to detect new threats, then detection accuracy can be maintained, but the response time to new threats is delayed
Solution Approach 1:
The system performs self-service by automatically generating and updating correlation rules using linear temporal logic based on continuous analysis of network traffic, user activities, system activities, and application activities. The Event Correlation Engine autonomously adapts to new threats by learning from observed patterns, eliminating the need for manual rule creation and update processes
Solution Approach 2:
The system performs preliminary correlation rule generation by continuously analyzing activity patterns and pre-computing correlation relationships using linear temporal logic. This preliminary analysis enables the system to immediately detect and respond to new threats as they emerge, without requiring time-consuming manual rule updates after threats are discovered
Data Source
Figure 1~3
Figure 4~5
Figure 6~7
AI summary
The present invention concerns a method of filtering network traffic to and from a computer device connected to a communication network, the method comprising: analysing system and application activity continuously; analysing network traffic to and from the computer device; detecting network events associated with the network traffic based on the network traffic analysis; determining a verdict associated with each network event indicating whether the network event is legitimate based on the system and application analysis; and filtering the network traffic based on the verdict of associated network events; wherein the method further comprises analysing user activity continuously; and wherein the verdict is further determined based on the user activity analysis.