Remote Administration Session Detection with Authorized Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems struggle to distinguish between authorized and malicious remote administration traffic, as malicious traffic often mimics legitimate administrator traffic, making it challenging to detect and prevent malicious activities.
Innovation Solution
A service that analyzes data from remote administration sessions to determine whether the traffic is authorized, flags authorized traffic, and uses this data to differentiate between benign and malicious traffic in the network, thereby preventing false alarms and mitigations for authorized sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network monitoring systems analyze all administration traffic to detect malicious activities, then detection capability improves, but false positives increase due to inability to distinguish authorized from malicious traffic
Solution Approach 1:
The system performs preliminary actions by establishing authorized administration sessions in advance and storing their characteristics (source/destination IPs, ports, protocols, time ranges) before malicious traffic appears. This allows the system to pre-configure detection rules that automatically recognize legitimate traffic patterns, enabling it to distinguish authorized from malicious traffic without generating false positives when analyzing subsequent administration traffic.
2Object-affected harmful factors
If the system blocks all suspicious administration traffic to prevent malicious activities, then security improves, but legitimate administrator activities are mistakenly blocked
Solution Approach 1:
The system segments administration traffic into distinct categories: authorized traffic (identified from pre-established sessions with known characteristics) and suspicious traffic (traffic that does not match authorized patterns). By dividing the traffic analysis into these separate segments, the system can apply different handling rules - allowing authorized traffic to pass freely while blocking only the suspicious segment, thereby maintaining security without interfering with legitimate administrator activities.
3Measurement precision
If the system monitors all administration sessions to identify authorized traffic, then accuracy improves, but system complexity increases
Solution Approach 1:
The system creates simplified copies or representations of authorized administration sessions by storing key identifying characteristics (source IP, destination IP, port numbers, protocol types, time ranges) in a database. Instead of performing complex real-time analysis of entire traffic streams, the system compares incoming traffic against these pre-created copies of authorized session profiles, significantly reducing computational complexity while maintaining high identification accuracy.
Data Source
AI summary
In one embodiment, a service receives administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device. The service analyzes the administration traffic data to determine whether any portion of the administration traffic data is resulting from an administration session involving a trusted administrator. The service flags a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from an administration session involving a trusted administrator, and a second portion of the administration traffic data is non-flagged. The service assesses the second portion of the administration traffic data using a machine learning-based traffic classifier to determine whether the second portion of the administration traffic data is malicious.