N-Gram Random String Detection for Suspicious Network Traffic

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies are unable to analyze network communications in real time to determine the likelihood of a communication message being suspicious or malicious, particularly when dealing with short strings, and often require analyzing whole paragraphs of text.

Innovation Solution

A machine-learning model is trained using N-grams substrings to classify strings as random or known, generating alerts for suspicious network activities by determining entropy values and using a cut-off threshold for classification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing technologies analyze whole paragraphs of text to detect suspicious activities, then detection accuracy is improved, but processing time and resource consumption increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts only the critical N-gram substrings from network communication messages rather than analyzing entire paragraphs of text. This extraction approach maintains detection accuracy by focusing on the most informative elements (N-grams with highest probability of indicating randomness) while significantly reducing processing time and resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the text analysis task into processing individual N-gram substrings rather than analyzing complete text blocks. By dividing the communication message into N-gram segments and evaluating each independently, the system achieves faster parallel processing while maintaining overall detection accuracy through aggregation of segment results.

Inventive Principle:

Principle #1Segmentation

2Reliability

If existing technologies require analyzing whole paragraphs of text, then detection reliability is improved, but device complexity increases

Engineering Contradiction:

Improvedetection reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces complex mechanical text analysis systems with a probabilistic N-gram based detection mechanism. Instead of using sophisticated algorithms to analyze entire text paragraphs, the system uses probability calculations on N-gram substrings, significantly reducing device complexity while maintaining detection reliability through statistical methods.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Speed

If blacklist-based blocking is used for malicious applications, then security response speed is improved, but adaptability decreases as malicious apps change names

Engineering Contradiction:

Improvesecurity response speedVSAvoiddetection adaptability

Core Design Contradiction:

SpeedVSAdaptability or versatility

Solution Approach 1:

The patent implements a dynamic detection system that evaluates N-gram probabilities in real-time rather than relying on static blacklist entries. This dynamic approach allows the system to adapt to changing malicious application names by continuously assessing the randomness characteristics of observed strings, maintaining both fast response speed and high adaptability.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the detection parameter from fixed string matching (blacklist names) to probabilistic N-gram analysis. By monitoring changes in N-gram probability patterns rather than relying on static application names, the system maintains rapid response while becoming highly adaptable to name-changing malicious applications.

Inventive Principle:

Principle #35Parameter changes

4Measurement precision

If servers monitor all possible password combinations for brute-force attacks, then detection precision is improved, but use of energy and computational resources increases

Engineering Contradiction:

Improveattack detection precisionVSAvoidcomputational energy

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies partial action by monitoring only the most informative N-gram substrings rather than analyzing complete authentication attempts. This partial monitoring approach maintains high detection precision for brute-force attacks by focusing on characteristic N-gram patterns while significantly reducing computational energy requirements.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12505170B2Random strings classification for detecting suspicious network activities

Publication Date: 2025.12.23 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A computing system is configured to train a machine-learning model for detecting suspicious network activities based on a training dataset. The training of the machine-learning model may be supervised or unsupervised training. The training dataset includes multiple strings. For each of the multiple strings, the computing system extracts one or more N-grams substrings, where N is a natural number that is equal to or greater than 2. The computing system then determines a probability of each N-grams substring that may occur in a string. When the machine-learning model is executed, it is configured to classify whether a given string contained in network communication is a random string. In response to classifying that the given string is a random string, an alert is generated at a particular computing system to which the network communication is directed.