Remote Administration Traffic Authorization for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems struggle to distinguish between authorized remote administration sessions and malicious traffic, particularly when malware-infected clients mimic legitimate administrator traffic, making detection of malicious activity challenging.
Innovation Solution
A service analyzes administration traffic data to determine authorization, flagging it as authorized, and uses this information to differentiate between benign and malicious traffic, preventing false alarms and enhancing machine learning classifiers' accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network monitoring systems analyze all administration traffic to detect malicious activity, then detection capability improves, but false positives increase due to inability to distinguish authorized from unauthorized traffic
Solution Approach 1:
The patent introduces an intermediary authorization verification mechanism that acts as a mediator between traffic detection and classification. This intermediary component verifies authorization status of administration traffic through multiple factors (source IP, destination IP, port, protocol, timing) before traffic is classified, thereby resolving the contradiction by enabling both high detection capability and high classification accuracy through the mediating authorization check
Solution Approach 2:
The patent applies preliminary action by performing authorization verification before traffic classification. The system pre-establishes authorization status by analyzing multiple parameters (source/destination IPs, ports, protocols, timing patterns) and stores this authorization information for subsequent classification use, thereby improving both detection reliability and classification precision through advance preparation
2Reliability
If machine learning classifiers are trained to detect malicious traffic patterns, then detection sensitivity improves, but authorized administration traffic is misclassified as malicious
Solution Approach 1:
The patent extracts authorized administration traffic from the general traffic pool before it reaches the machine learning classifier. By separately identifying and handling authorized traffic through authorization verification (using source IP, destination IP, port, protocol, and timing analysis), the system removes authorized traffic from the classification process, thereby maintaining high detection sensitivity while eliminating false alarms from misclassified authorized traffic
Solution Approach 2:
The patent segments traffic handling into distinct pathways: authorized administration traffic follows one path (verified through authorization checks) while other traffic follows another path (processed by machine learning classifiers). This segmentation separates authorized from unauthorized traffic processing, allowing the classifier to focus on detecting actual threats without being confused by legitimate administration traffic, thus reducing false alarms while maintaining detection sensitivity
Data Source
AI summary
In one embodiment, a service receives administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device. The service analyzes the administration traffic data to determine whether any portion of the administration traffic data is resulting from an administration session involving a trusted administrator. The service flags a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from an administration session involving a trusted administrator, and a second portion of the administration traffic data is non-flagged. The service assesses the second portion of the administration traffic data using a machine learning-based traffic classifier to determine whether the second portion of the administration traffic data is malicious.