Peer-Based Network Security System for Malicious Communication Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise systems face challenges in securing networks against malicious communications due to infected applications that can compromise other applications, with existing solutions failing to effectively identify and block such threats in a scalable and efficient manner.
Innovation Solution
A network security system that assigns trust levels to applications based on historical communication patterns, using a centralized tool and peer-based cooperation to evaluate and block malicious communications, with a recurrent neural network to identify patterns indicative of malware and update trust levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a centralized system monitors all communications to identify malicious applications, then detection accuracy improves, but system complexity and computational resource consumption increase
Solution Approach 1:
The patent divides the centralized monitoring system into distributed peer applications across multiple computer systems. Each peer application independently monitors communications involving its host application, eliminating the need for a single complex centralized system while maintaining comprehensive detection coverage through distributed observation points.
Solution Approach 2:
Each peer application autonomously evaluates communications using local trust levels and probability thresholds without requiring centralized coordination. The system performs self-service security monitoring where each node independently makes security decisions based on its own analysis of communication patterns and trust assessments.
2Reliability
If comprehensive communication monitoring is implemented across all applications, then security reliability improves, but computational resource consumption increases
Solution Approach 1:
The patent implements local quality assessment by maintaining trust levels specific to each application pair rather than universal monitoring rules. Each peer application evaluates communications based on localized trust relationships and historical patterns specific to that application pair, reducing unnecessary computational analysis of low-risk communications while maintaining high security for suspicious interactions.
Solution Approach 2:
The system dynamically adjusts probability thresholds and trust level parameters based on observed communication patterns and threat levels. By changing these parameters adaptively, the system optimizes computational resource usage by raising thresholds for low-risk applications (reducing false positives and unnecessary analysis) while lowering thresholds for high-risk applications (increasing detection sensitivity).
3Measurement precision
If trust levels are dynamically updated based on communication patterns, then detection precision improves, but processing time increases
Solution Approach 1:
The patent pre-calculates and stores trust levels for application pairs based on historical communication patterns before actual security decisions are needed. By performing this analysis in advance and maintaining cached trust level data, the system avoids time-consuming real-time analysis during critical security evaluation moments, reducing processing delays while maintaining detection precision.
4Adaptability or versatility
If peer-based cooperation is implemented across the network, then system scalability improves, but communication overhead increases
Solution Approach 1:
The patent extracts only the essential trust level information from peer applications rather than transmitting complete communication logs or detailed analysis data. By extracting and sharing only the critical trust assessment parameters, the system enables scalable peer-based cooperation while minimizing network communication overhead to only the necessary security-relevant data.
Data Source
AI summary
A computer system configured to execute an application includes a memory and a processor. The memory stores lists of trusted, malicious, and peer applications. Each application of the trusted list is associated with a maliciousness probability that is less than a lower threshold. Each application of the malicious list is associated with a maliciousness probability that is greater than an upper threshold. The peer list includes a peer application installed on a second computer system, which stores a second list of malicious applications. The processor determines that a second application not listed in the trusted or malicious lists is attempting to transmit a communication to the application. In response, the processor transmits a message to the peer application inquiring about the second application. The processor receives a response indicating that the second application is included in the second list of malicious applications and refuses the communication.