Random String Classification Using N-Grams for Real-Time Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security technologies are unable to analyze network communications in real time to determine the likelihood of suspicious or malicious activities, particularly those involving randomly generated strings, and require analyzing whole paragraphs of text, which is resource-intensive and impractical for near-real-time detection.
Innovation Solution
A machine-learning model is trained to classify random strings by extracting N-grams substrings from network communications, determining their probabilities and entropy values, and generating alerts when the entropy exceeds a cut-off threshold, indicating potential suspicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security technologies analyze network communications to detect suspicious activities, then detection capability is provided, but real-time analysis is not achieved and resource consumption is high
Solution Approach 1:
The patent segments the analysis process into two phases: offline training phase where the machine learning model is trained on historical data, and online detection phase where the trained model performs rapid real-time classification. This segmentation allows complex analysis to be done offline while enabling fast real-time detection during operation.
Solution Approach 2:
The patent performs preliminary action by training the machine learning model offline before actual deployment. The model learns from historical network communication data during the offline phase, so that when real-time detection is needed, the pre-trained model can immediately classify new strings without requiring complex real-time computation.
2Measurement precision
If existing technologies analyze whole paragraphs of text to determine suspicious activities, then detection accuracy is improved, but resource demands increase and efficiency decreases
Solution Approach 1:
The patent extracts only the relevant string elements from network communications for analysis, rather than processing entire paragraphs or messages. The machine learning model is trained to classify based on these extracted strings, significantly reducing the amount of data to be processed while maintaining detection accuracy.
Solution Approach 2:
The patent applies different processing approaches to different parts of the network communication data. Instead of uniformly analyzing entire messages, the system focuses computational resources on analyzing specific string elements that are most indicative of suspicious activity, as identified by the trained machine learning model.
3Reliability
If blacklist-based blocking is used for malicious applications, then known threats are blocked, but malicious applications can easily evade by changing names
Solution Approach 1:
The patent implements a feedback mechanism where the machine learning model continuously learns from new data. When new malicious applications are detected, their characteristics are fed back into the training process, allowing the model to adapt and recognize new threat patterns without requiring manual blacklist updates.
Solution Approach 2:
The patent transitions from a static blacklist approach to a dynamic machine learning-based detection system. The model can adapt its classification criteria based on learned patterns, enabling it to recognize malicious applications regardless of their specific names or slight variations, thus countering evasion tactics.
Data Source
AI summary
A computing system is configured to train a machine-learning model for detecting suspicious network activities based on a training dataset. The training of the machine-learning model may be supervised or unsupervised training. The training dataset includes multiple strings. For each of the multiple strings, the computing system extracts one or more N-grams substrings, where N is a natural number that is equal to or greater than 2. The computing system then determines a probability of each N-grams substring that may occur in a string. When the machine-learning model is executed, it is configured to classify whether a given string contained in network communication is a random string. In response to classifying that the given string is a random string, an alert is generated at a particular computing system to which the network communication is directed.