Peer-to-Peer Communication Detection via Log Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting peer-to-peer communication in networks rely heavily on pattern recognition, which is inadequate for new software types and viruses, making it difficult to effectively monitor and control peer-to-peer communication.
Innovation Solution
A communication detection device and method that analyzes communication logs by dividing them into parts corresponding to individual devices, generating a response success/failure table based on connection requests, and determining peer-to-peer communication by identifying time periods with no response that meet predetermined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern-based detection methods are used for peer-to-peer communication, then detection accuracy for known software is improved, but the ability to detect new software types and viruses deteriorates
Solution Approach 1:
The patent changes the detection parameter from static pattern matching to dynamic behavior analysis. Instead of comparing communication data against predefined patterns, the system monitors communication behavior over time, tracking parameters such as connection frequency, data exchange patterns, and interaction timing. This allows the system to adapt to new peer-to-peer software by recognizing behavioral characteristics rather than relying on known software patterns.
Solution Approach 2:
The patent replaces the mechanical pattern-matching system with a behavioral analysis system. Rather than using rigid pattern templates that must be manually updated, the system observes and analyzes communication behaviors, automatically identifying peer-to-peer interactions based on characteristic behavioral patterns such as direct device-to-device communication without server mediation.
2Measurement precision
If pattern generation is performed manually by experts, then detection precision for known threats is improved, but the speed of adapting to new threats deteriorates
Solution Approach 1:
The patent implements a self-service detection system that automatically analyzes communication behaviors without requiring expert intervention for pattern generation. The system autonomously monitors network traffic, identifies peer-to-peer communication patterns, and adapts to new software types by observing their behavioral characteristics. This eliminates the need for manual pattern creation while maintaining high detection precision.
Solution Approach 2:
The patent performs preliminary behavioral analysis by continuously monitoring and recording communication patterns in advance. Instead of waiting for new threats to appear and then manually creating patterns, the system proactively collects and analyzes communication data, building a baseline of normal and abnormal behaviors that enables rapid detection of new peer-to-peer software.
3Quantity of substance
If communication logs are analyzed in aggregate, then overall network monitoring capability is improved, but the ability to identify specific device behavior deteriorates
Solution Approach 1:
The patent segments communication logs by dividing them into individual device-specific subsets. Instead of analyzing all network traffic as a single aggregate dataset, the system separates logs by source and destination devices, enabling precise analysis of each device's communication behavior. This segmentation allows the system to identify peer-to-peer activities on specific devices while maintaining the benefit of analyzing overall network traffic patterns.
Data Source
AI summary
A communication detection method in which, based on a sender and a destination of communication data recorded in a communication log that records information concerning communication data exchanged between devices linked to a network, the communication log is divided into parts corresponding to individual object devices. The communication logs divided corresponding to the individual devices are analyzed so that the communication data in which a connection request to each device has been issued is extracted, and then a response success/failure table is generated based on whether a response from the device to the connection request has been detected; and based on the response success/failure table, when a time period that no response is obtained from the device satisfies a criterion condition determined in advance, it is determined that peer-to-peer communication has been performed.