Polling Robot for Malicious Activity Detection in LAN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based computing systems face challenges in detecting and preventing malicious activities, such as cryptocurrency mining, due to lack of access to user data within virtual machines and the ability to monitor external data like IP addresses and access ports, which are used by malicious users to abuse trial accounts and resources.
Innovation Solution
A supervisory electronic device monitors usage information and network resources within a Local Area Network (LAN) to identify potential malicious activities by analyzing CPU and disk usage patterns and specific port access, employing a polling robot to transmit ping messages based on pre-determined formats associated with malicious activities, such as blockchain mining, and determines the presence of malicious activity through response message analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cloud-based computing systems monitor usage information and network resources to detect malicious activities, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The system segments the detection process into multiple independent modules: a polling robot that collects network resource data, a usage information analyzer that processes monitoring data, and a malicious activity detector that identifies threats. Each module operates independently but contributes to the overall detection accuracy, resolving the contradiction by distributing complexity across modular components rather than concentrating it in a single complex system.
Solution Approach 2:
The patent introduces an intermediary polling robot that acts as a mediator between the monitoring system and network resources. This robot collects usage information and network resource data without requiring direct access to virtual machine internals, thereby maintaining detection accuracy while simplifying the overall system architecture by decoupling the detection logic from the monitored environments.
2Measurement precision
If the system analyzes detailed usage information including CPU and disk patterns to identify malicious activities, then detection precision improves, but processing time increases
Solution Approach 1:
The system performs preliminary actions by continuously collecting and storing usage information in logs before malicious activities need to be detected. The polling robot proactively gathers network resource data and usage patterns in advance, creating a ready-to-analyze dataset that enables rapid detection when suspicious activities occur, thus improving detection precision without increasing processing time during actual detection events.
Solution Approach 2:
The monitoring system implements periodic action by scheduling regular collection of usage information at predetermined intervals. This periodic polling approach allows the system to analyze CPU and disk patterns over time to identify malicious activities with high precision, while the distributed time-based sampling reduces peak processing loads compared to continuous monitoring.
3Reliability
If the system monitors external data such as IP addresses and access ports, then ability to detect abuse of trial accounts improves, but data access requirements increase
Solution Approach 1:
The polling robot implements self-service by autonomously collecting its own usage information and network resource data without requiring manual configuration or direct access to sensitive systems. It independently queries network resources, retrieves IP addresses and port information, and processes this data to detect trial account abuse, thereby improving detection capability while minimizing the complexity of data access requirements through automated self-directed data collection.
Data Source
AI summary
There is disclosed a method for identifying malicious activity, the method being executable by a supervisory electronic device. The method comprises accessing, a log to retrieve usage information associated with at least a portion of the plurality of electronic devices; analyzing the usage information to identify a subset of electronic devices; analyzing a list of network resources accessed; executing, by the supervisory electronic device a polling robot, the polling robot configured to: transmit to each of the list of network resources a ping message, the ping message having a first pre-determined format having been generated based on the malicious activity; analyzing, the response message; responsive to the response message having a second pre-determined format, the second pre-determined format having been identified based on the pre-determined type of malicious activity: determining that an associated network resource having generated the response message is associated with malicious activity.