OS Identification for Malware Remediation in NAT Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-based malware detection systems face challenges in identifying specific devices behind a Network Address Translation (NAT) device, as they cannot distinguish between individual devices sharing the same IP address, making focused remediation procedures difficult.
Innovation Solution
A method and system that receive TCP packets to determine the operating system identifier (OS ID) associated with a computing device, compare malware signatures, and generate alerts with network addresses and OS IDs to facilitate targeted remediation, using techniques like TCP session tracking and OS fingerprinting to identify specific devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT device maps LAN addresses to single WAN IP address, then multiple devices can access internet, but specific infected device cannot be identified
Solution Approach 1:
The patent segments the identification process by analyzing individual TCP packet characteristics (TTL values, window sizes, TCP options) from each device behind the NAT device. This allows the system to distinguish between multiple devices sharing the same WAN IP address by identifying unique fingerprint patterns in their respective TCP streams, thereby resolving the identification precision issue while maintaining NAT's multi-device access capability
Solution Approach 2:
The patent applies local quality by examining specific local characteristics of TCP packets (such as TTL values, window scaling factors, and TCP option orders) that are uniquely set by each operating system. These localized packet features serve as device-specific identifiers that enable precise identification of infected devices without affecting the overall NAT functionality
2Measurement precision
If TCP packet analysis is performed to identify OS, then device identification accuracy improves, but processing complexity increases
Solution Approach 1:
The patent extracts only the essential TCP packet features needed for OS identification (TTL values, window sizes, TCP option presence and order) from the complete packet stream. By selecting and analyzing only these specific characteristics rather than processing entire packets, the system achieves accurate OS identification while minimizing processing complexity and computational overhead
Solution Approach 2:
The patent performs preliminary OS identification by analyzing TCP handshake packets (SYN, SYN-ACK, ACK) before full malware detection and remediation processes. This preliminary action establishes device identity early in the connection lifecycle, allowing subsequent security operations to be targeted efficiently without requiring continuous complex analysis of all traffic
Data Source
AI summary
A method and system for providing network based malware detection in a service provider network is disclosed. Transmission control protocol (TCP) packets defining originating from an access device coupled to the service provider network defining a TCP session between a computing device coupled to the access device, and a destination coupled to the service provider network are received. An operating system identifier (OS ID) associated with the TCP session and the computing device is determined. If malware is present in the TCP session and an associated malware ID is determined by comparing a malware signature to the one or more TCP packets. An alert identifying a network address associated with the access device, the malware ID and the OS ID associated with TCP session that generated the alert can then be generated.