Probabilistic Model for Unknown Malicious Entity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Intrusion Detection Systems (IDS) and anti-malware solutions require a sample of malware to be analyzed before detecting more instances, providing attackers with a delay between discovery and effective defense, as they are ineffective against new malicious entities not yet known to the defender.
Innovation Solution
A network security device uses a probabilistic model based on observed entities' behavior to correlate features such as email addresses, IP addresses, and organization names with malicious or benign behavior, predicting and blocking unknown malicious entities before they send traffic, by applying network policies based on shared features from databases like the WHOIS database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based IDS/anti-malware solutions are used, then detection accuracy for known malware is improved, but the system becomes ineffective against new malicious entities not yet in the database
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing relational data from multiple sources (WHOIS database, social networks, email records) before malicious entities are actively observed. This advance preparation creates a probabilistic model that can identify and block new malicious domains proactively, rather than reactively after infection occurs.
Solution Approach 2:
The patent introduces relational data (email addresses, IP addresses, organization names) as intermediary elements that connect observed malicious entities to unobserved potential threats. These intermediaries serve as bridges to infer the malicious nature of unknown entities through shared relationships, enabling detection without direct observation of the malicious behavior itself.
2Measurement precision
If more observational data is collected to improve detection accuracy, then the system becomes slower to respond to new threats
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing relational data from multiple sources (WHOIS database, social networks, email records) before malicious entities are actively observed. This advance preparation creates a probabilistic model that can identify and block new malicious domains proactively, rather than reactively after infection occurs.
Solution Approach 2:
The system changes parameters by shifting from direct behavioral observation to relational feature analysis. Instead of waiting to observe malicious actions (time-consuming), the system analyzes static relational attributes (email addresses, IP addresses, organization names) that can be quickly queried from databases, significantly reducing detection time while maintaining precision through the probabilistic model.
3Reliability
If the system blocks more entities to reduce false negatives, then false positives increase
Solution Approach 1:
The system implements feedback through the probabilistic model that calculates likelihood scores based on multiple relational features. This feedback mechanism allows the system to adjust its blocking decisions dynamically, only blocking entities that exceed a confidence threshold, thereby maintaining high security coverage while controlling false positive rates through quantitative risk assessment.
Solution Approach 2:
The patent combines multiple data sources (WHOIS database, social network data, email records, observed malicious entities) into a composite probabilistic model. This composite approach integrates diverse evidence types to create a more robust detection system that reduces false positives by requiring convergence of multiple indicators rather than relying on single-feature matching.
Data Source
AI summary
Data is collected from a database arrangement about behavior of observed entities, wherein the collected data includes one or more features associated with the observed entities. A probabilistic model is determined that correlates the one or more features with malicious and/or benign behavior of the observed entities. Data is collected from the database arrangement for unobserved entities that have at least one common feature with at least one of the observed entities. One of the unobserved entities is determined to be a malicious entity based on the at least one common feature and the probabilistic model. Network policies are applied to packets sent from the malicious entity.