Persistent Network Connection Detection via Outlier Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively distinguish between malicious and legitimate persistent network connections, often misclassifying malicious connections as legitimate during the learning phase, making it difficult to identify them later.
Innovation Solution
A method that determines persistent connections by using a sliding window to calculate connection persistence and collects statistics for feature vector creation, employing outlier detection to separate malicious from legitimate connections, with features such as average flow duration and surprisal values to identify anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional learning phase methods are used to classify network connections, then legitimate connections are learned and recognized, but malicious connections are misclassified as legitimate and cannot be identified later
Solution Approach 1:
The patent segments the detection process into distinct phases: a learning phase that collects statistics from all connections, and a detection phase that uses outlier detection on feature vectors. This segmentation allows the system to learn normal behavior patterns without making premature classification decisions that could mislabel malicious connections.
Solution Approach 2:
The system performs preliminary action by collecting comprehensive connection statistics during a learning phase before actual detection begins. This preliminary data collection builds a baseline of normal connection behavior that enables accurate later detection without having to classify connections during the learning phase itself.
2Productivity
If persistent connections are monitored using traditional methods, then connection frequency is tracked, but malicious connections cannot be distinguished from legitimate ones
Solution Approach 1:
The patent transitions from monitoring single-dimensional connection frequency to analyzing multi-dimensional feature vectors that include inter-arrival times, persistence values, and statistical distributions. This dimensional expansion enables the outlier detection algorithm to distinguish malicious patterns that would be invisible in simple frequency counting.
Solution Approach 2:
The system replaces traditional mechanical filtering methods with statistical outlier detection based on probability distributions. Instead of using fixed thresholds or rule-based filtering, the system uses statistical models to identify connections that deviate from normal patterns, providing more precise malicious connection identification.
3Reliability
If all persistent connections are flagged for inspection, then potential malicious connections are captured, but false positives increase significantly
Solution Approach 1:
The system uses feedback from the statistical model to dynamically adjust detection thresholds and identify only the most anomalous connections. The outlier detection algorithm continuously refines its understanding of normal behavior and uses this feedback to distinguish true anomalies from variations in legitimate traffic patterns.
Solution Approach 2:
The patent changes the detection parameter from binary persistent/non-persistent classification to continuous outlier scores based on statistical distance from normal behavior. This parameter transformation allows the system to prioritize inspections based on anomaly severity rather than flagging all persistent connections equally, reducing false positives while maintaining detection reliability.
Data Source
AI summary
In one embodiment a method, system and apparatus is described for detecting a malicious network connection, the method system and apparatus including determining, for each connection over a network, if each connection is a persistent connection, if, as a result of the determining, a first connection is determined to be a persistent connection, collecting connection statistics for the first connection, creating a feature vector for the first connection based on the collected statistics, performing outlier detection for all of the feature vector for all connections over a network which have been determined to be persistent connections, and reporting detected outliers. Related methods, systems and apparatus are also described.