Proxy Log Analysis for Malicious Executable Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security sandboxing methods are costly and require extensive maintenance to keep up with evolving threats, with time and cost restrictions limiting the evaluation of executables and making it difficult to detect malicious activity effectively.
Innovation Solution
Analyzing proxy logs to identify malicious executables by retrieving and analyzing network traffic logs from multiple nodes, allowing for on-demand analysis and capturing traffic over extended periods without the need for a controlled environment, thereby increasing throughput and reducing costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing is used to evaluate executables, then malicious activity can be identified, but the cost and maintenance requirements increase significantly
Solution Approach 1:
The patent uses proxy servers as intermediaries between the executable and the network. The proxy server captures network traffic generated by the executable without requiring a full sandbox environment. This mediator approach maintains security analysis capability while eliminating the complexity of maintaining controlled sandbox environments.
Solution Approach 2:
The patent extracts only the necessary network traffic data from the executable's operation by using proxy servers to capture HTTP/HTTPS requests. Instead of maintaining the entire sandbox environment, only the relevant network communication aspects are extracted and analyzed for malicious activity detection.
2Productivity
If sandboxing time is limited to 5 minutes, then throughput increases, but the ability to detect certain malicious activities decreases
Solution Approach 1:
The system performs preliminary network traffic capture and logging by proxy servers before executable analysis is needed. Network traffic data is pre-collected and stored, allowing rapid retrieval and analysis without time-limited sandbox execution. This preliminary data collection enables both high throughput and comprehensive detection.
Solution Approach 2:
The patent shifts from time-based analysis (sandbox execution duration) to data-based analysis (network traffic log volume). Instead of limiting analysis to 5 minutes of execution, the system analyzes network traffic logs that can capture behavior over extended periods, adding a dimensional shift from temporal constraint to data quantity flexibility.
3Reliability
If sandboxing is used to remain up to date with evolving threats, then detection accuracy improves, but maintenance costs increase
Solution Approach 1:
The system implements feedback mechanisms where proxy servers continuously collect network traffic data from multiple sources, analyze patterns, and update detection rules. This ongoing feedback loop maintains up-to-date threat detection capabilities through data-driven improvements rather than manual sandbox configuration updates.
Solution Approach 2:
The proxy server infrastructure serves multiple functions: capturing network traffic, storing logs, analyzing patterns, and updating detection rules. This multi-functional system replaces the specialized sandbox environment, maintaining threat detection accuracy while reducing the complexity of maintaining separate update mechanisms for each sandbox instance.
Data Source
AI summary
Identifying malicious executables by analyzing proxy logs includes, at a server having connectivity to the Internet, retrieving sets of proxy logs from a plurality of proxy servers. Each proxy server of the plurality of proxy servers is associated with a network and generates network traffic logs for one or more nodes included in the network. Then, a set of executables hosted by each of the one or more nodes associated with each of the plurality of proxy servers is determined. Each set of executables is analyzed to detect a specific executable and portions of each of the network traffic logs that are associated with the specific executable are identified. An alert is generated indicating the portions of each of the network traffic logs as likely to be associated with the specific executable.