Outbound Traffic Anomaly Scoring for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks face challenges in detecting malicious outbound traffic due to the difficulty in identifying new command and control centers, leading to unfettered access for malicious parties until an exploit is recognized, and existing solutions suffer from high false positives and user fatigue.
Innovation Solution
A system that detects emergent abnormal behavior in computer networks by scoring outbound communications based on feature pairs and aggregating scores to provide near real-time security alerts without relying on blacklists, differentiating between anomalous and widespread behaviors to reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklists are used to block known command and control centers, then known threats are blocked, but new command and control centers cannot be identified in time
Solution Approach 1:
The system performs preliminary analysis of outbound traffic patterns, device behaviors, and network metadata before malicious activity is confirmed. By continuously monitoring and scoring potential anomalies in advance, the system can rapidly respond to new command and control centers without waiting for blacklist updates or manual analysis.
Solution Approach 2:
The system implements continuous feedback loops where detected anomalies are scored, aggregated, and used to update detection models in real-time. This feedback mechanism allows the system to adapt to new threats dynamically, improving detection of emerging command and control centers while maintaining reliability against known threats.
2Measurement precision
If traditional detection methods are used, then security threats are identified, but false positives cause user fatigue
Solution Approach 1:
The system applies different scoring criteria and aggregation methods to different types of traffic and devices based on their specific characteristics. By tailoring the detection approach to local contexts (device type, network role, traffic patterns), the system improves detection precision while reducing false positives that would otherwise contribute to analyst fatigue.
Solution Approach 2:
The system dynamically adjusts detection parameters and scoring thresholds based on aggregated abnormality scores and incident scores. By changing parameters adaptively rather than using fixed thresholds, the system maintains high detection accuracy while filtering out false positives, thereby reducing the workload on security analysts.
3Measurement precision
If comprehensive traffic analysis is performed, then detection accuracy improves, but processing time and complexity increase
Solution Approach 1:
The system segments the traffic analysis process into distinct scoring stages (anomaly scoring, aggregation, incident scoring) that can be processed independently and in parallel. This segmentation reduces processing complexity by breaking down comprehensive analysis into manageable components while maintaining overall detection accuracy through the cumulative effect of multiple scoring layers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Detecting emergent abnormal behavior in a computer network faster and more accurately allows for the security of the network against malicious parties to be improved. To detect abnormal behavior, outbound traffic is examined from across several devices and processes in the network to identify rarely communicated-with destinations that are associated with rarely-executed processes. As a given destination and process is used more frequently over time by the network, the level of suspicion associated with that destination and process is lowered as large groups of devices are expected to behave the same when operating properly and not under the control of a malicious party. Analysts are alerted in near real-time to the destinations associated with the activities deemed most suspicious.