Network Worm Detection Through Adaptive Host Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current worm detection technologies suffer from low identification accuracy due to high false positive rates, particularly in complex enterprise networks where normal host activities can mimic worm-infected behavior.
Innovation Solution
A worm detection method that utilizes a trained worm detection model based on network behavior analysis, generating a prediction result by analyzing session information of hosts to determine if they are worm-infected, and constructing propagation chains to assess worm impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threshold-based worm detection is used to identify worm-infected hosts, then worm detection capability is improved, but false positive rate increases and identification accuracy deteriorates
Solution Approach 1:
The patent transforms the detection approach from using single threshold parameters to using multiple behavioral parameters (scan count, connection count, data transfer volume, session duration) that are dynamically adjusted based on network conditions. This allows the system to distinguish between normal high-activity hosts and actual worm-infected hosts by analyzing the pattern and combination of behaviors rather than relying on a single threshold value.
Solution Approach 2:
The detection system implements dynamic thresholds and time-window-based analysis that adapt to changing network conditions. Instead of static thresholds, the system continuously monitors host behavior patterns over time and adjusts detection criteria based on learned normal behavior for different network segments, reducing false positives while maintaining detection effectiveness.
2Device complexity
If simple threshold-based detection is applied uniformly across all networks, then detection simplicity is improved, but adaptability to different network behaviors deteriorates
Solution Approach 1:
The patent divides the network into multiple segments or zones and applies detection rules specific to each segment's normal behavior patterns. By segmenting the network and analyzing behavior locally rather than applying a uniform threshold across the entire network, the system adapts to different network types (enterprise, campus, data center) while maintaining manageable complexity through modular detection rules.
Solution Approach 2:
The system performs preliminary learning of normal host behaviors during an initialization phase before applying detection rules. By pre-establishing baseline behavior patterns for each network segment through observation and learning, the system prepares adaptive detection criteria in advance, allowing it to handle diverse network behaviors without requiring complex real-time adjustments.
Data Source
AI summary
A worm detection method and a network device, the method including obtaining first session information of a first host in a first time window, the first session information being session information of the first host that is actively connecting to one or more other hosts, determining, based on the first session information, a data feature corresponding to the first host, the data feature corresponding to the first host describing behavior of the first host accessing the one or more other hosts, and obtaining a prediction result by analyzing, based on a worm detection model, the data feature corresponding to the first host, where the worm detection model is a model generated by training data features corresponding to a plurality of hosts in a first network in which the first host is located, and wherein the prediction result indicates whether the first host is worm-infected.