Malware Inspection via OpenFlow Switch Packet Redirection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face challenges in safely monitoring and collecting cyber threat intelligence from personal computers infected with malware within a system controlled by a command and control server located outside the system, as they struggle to effectively isolate and manage unauthorized access.
Innovation Solution
A malware inspection support system utilizing an OpenFlow switch and controller to redirect and isolate infected terminals by modifying packet addresses and paths, allowing safe monitoring and intelligence collection by mimicking the network configuration of a honeynet system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If infected terminals are isolated to prevent malware spread, then system security is improved, but communication with command and control server is disrupted
Solution Approach 1:
The patent introduces a network switch as an intermediary device between infected terminals and the network. This switch captures packets from infected terminals, modifies their destination addresses to redirect to a honeynet instead of the command and control server, and forwards them accordingly. This mediator approach allows the system to maintain monitoring capabilities while preventing actual malware communication.
Solution Approach 2:
The patent creates a virtual copy of the network environment through a honeynet that mimics the original system configuration. Infected terminals are redirected to this copied environment where their malicious communications are captured and analyzed without affecting the real system. The honeynet serves as a duplicate that preserves communication patterns for analysis while isolating threats.
2Reliability
If packet address modification is implemented to redirect traffic, then malware communication is prevented, but network traffic management complexity increases
Solution Approach 1:
The patent modifies packet parameters (destination IP addresses and MAC addresses) at the network switch level to redirect traffic from infected terminals. By changing these address parameters, the system automatically reroutes malicious communications to the honeynet without requiring complex policy configurations or manual intervention for each packet.
Solution Approach 2:
The network switch is configured to automatically perform packet inspection, address modification, and redirection based on predefined rules. The system self-manages the complex task of identifying infected terminal traffic and redirecting it appropriately without requiring continuous human oversight or complex external management systems.
3Loss of information
If honeynet system is deployed to collect threat intelligence, then cyber threat intelligence gathering is improved, but system configuration complexity increases
Solution Approach 1:
The patent segments the network into distinct functional zones: the original system network, the honeynet (virtual copy), and the network switch serving as the boundary. This segmentation allows threat intelligence collection in the isolated honeynet environment while keeping the original system configuration simple and unchanged. Each segment serves a specific purpose without requiring complex integration.
Solution Approach 2:
The network switch acts as an intermediary that simplifies honeynet integration by handling all complex packet redirection and address modification tasks. This mediator approach allows the honeynet to be configured as a relatively simple virtual copy, while the switch manages the complexity of interfacing it with the production network.
Data Source
AI summary
A malware inspection support system includes one or more processors configured to, when a first terminal belonging to a first system is infected with malware, in response to receiving, from the first terminal, a first packet destined for a second terminal belonging to the first system, change a destination address of the first packet to an address of a third terminal belonging to a second system, and transmit the changed first packet to the third terminal, generate a port group by grouping a first port to which the first terminal is coupled and a second port to which the second system is coupled, transmit a broadcast packet received from the first terminal to the port group, and change a source address of another broadcast packet received from the third terminal to an address of the second terminal, and transmit the changed other broadcast packet to the port group.