Passive Worm Detection via Peer File List Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious files, such as passive worms, in peer-to-peer networks are ineffective as they rely on signature databases for known threats and Intrusion Detection Systems that cannot detect passive worms, which generate normal traffic and do not actively seek to infect peers.
Innovation Solution
A method that compares lists of files shared by peers to identify common files, determining if the number of common files exceeds a threshold, indicating fraudulent installation, and uses supervision probes to track file downloads and send identifiers for detection, allowing for the identification of passive worms and their clones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based antivirus software is used to detect worms, then known worms and viruses can be detected, but it cannot detect new or unknown passive worms
Solution Approach 1:
The system performs preliminary actions by monitoring and recording file addition events in shared directories before worms can spread. It proactively tracks which files are added by whom and when, creating a baseline of normal file sharing behavior that enables later detection of anomalous patterns characteristic of passive worm propagation
Solution Approach 2:
The system implements feedback loops where detection results from comparing file lists across peers are fed back into the monitoring process. When suspicious patterns are detected (multiple peers adding identical files to shared directories), the system generates alerts and updates its detection criteria, continuously improving its ability to identify both known and unknown passive worms
2Object-affected harmful factors
If Intrusion Detection Systems are used to analyze peer traffic, then active worm activity can be detected, but passive worms generating normal traffic cannot be detected
Solution Approach 1:
The system transitions from analyzing traffic flow patterns (traditional IDS approach) to examining the dimensional characteristics of file metadata itself. By monitoring file addition events, timestamps, and peer identities in the file sharing directory structure, it detects passive worms through their behavioral signature of systematically adding files to shared directories, rather than through traffic analysis
3Reliability
If file lists from multiple peers are compared to detect common files, then passive worms can be identified, but the system complexity increases
Solution Approach 1:
The detection system is segmented into independent modular components: file list collection modules that gather data from individual peers, a comparison engine that analyzes the collected lists, and an alert generation module. Each peer's file list is processed independently and then compared against others, allowing the system to scale by simply adding more peer monitoring without increasing overall system complexity
Data Source
Figure 1~2E
Figure 3~5
Figure 6~7
AI summary
The present invention relates to a method that enables the detection of at least one fraudulently installed file in a peer of a peer-to-peer network by comparing a list of files, locally added in an area of files shared in the network by said peer, with that of at least one other peer from which the peer downloaded at least a file fragment.