Sequence Graph Analysis for Obscure Cyclic Message Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional anomaly-detection technologies are ineffective in identifying obscure cyclic application-layer message sequences in Industrial Control Systems (ICS) networks due to proprietary protocols and lack of semantic bookending in transport-layer connections, making it difficult to baseline normal traffic and detect malfunctioning or compromised devices.

Innovation Solution

A method involving the collection of composite transport-layer message sequences, construction of a sequence graph, traversal to discover obscure cyclic sequences, and performance of security actions using representations of these sequences, allowing for application-protocol agnostic detection of anomalies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional anomaly-detection technologies are used to detect cyclic message sequences in ICS networks, then the detection process requires understanding message structure and purpose, but the proprietary and undocumented application-layer protocols make this understanding impossible

Engineering Contradiction:

Improvedetection accuracyVSAvoidprotocol understanding difficulty

Core Design Contradiction:

Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces an intermediary layer that operates at the transport layer (TCP/IP) rather than requiring application-layer protocol understanding. This intermediary captures and analyzes message sequences, sources, and destinations without needing to interpret the proprietary application protocols, thereby resolving the contradiction between detection accuracy and protocol understanding difficulty

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical approach of parsing and understanding application-layer message structures with a statistical pattern recognition system that operates on transport-layer metadata (sources, destinations, sequence patterns). This substitution eliminates the need for protocol knowledge while maintaining detection capability

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Quantity of substance

If conventional anomaly-detection systems collect instances of cyclic message sequences for baselining, then sufficient data collection is needed, but the lack of semantic bookending in long-lived transport-layer connections makes instance identification difficult

Engineering Contradiction:

Improvenumber of message sequence instancesVSAvoidinstance identification difficulty

Core Design Contradiction:

Quantity of substanceVSDifficulty of detecting and measuring

Solution Approach 1:

The patent segments the continuous stream of transport-layer messages into discrete cyclic sequence instances by identifying repeating patterns of sources, destinations, and message sequences. This segmentation allows the system to collect multiple instances of the same cyclic pattern without requiring application-layer semantic bookending, thereby resolving the contradiction between quantity needed and identification difficulty

Inventive Principle:

Principle #1Segmentation

3Adaptability or versatility

If proprietary application-layer protocols are used in ICS networks, then specialized functionality is achieved, but the protocols become hidden and undocumented making baseline establishment impossible

Engineering Contradiction:

Improvespecialized functionalityVSAvoidprotocol documentation

Core Design Contradiction:

Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent introduces a transport-layer intermediary that observes and analyzes message patterns without requiring access to or understanding of the proprietary application protocols. This intermediary captures sufficient information (sources, destinations, sequence patterns) to establish baselines while the proprietary protocols maintain their specialized functionality unchanged, resolving the contradiction between adaptability and information loss

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10200259B1Systems and methods for detecting obscure cyclic application-layer message sequences in transport-layer message sequences

Publication Date: 2019.02.05 CA TECH INC

AI summary

The disclosed computer-implemented method for detecting obscure cyclic application-layer message sequences in transport-layer message sequences may include (i) collecting a composite sequence of transport-layer messages that are exchanged between a first computing device and a second computing device over a single long-standing transport-layer connection, (ii) constructing a sequence graph from the composite sequence, (iii) traversing the sequence graph to discover a first obscure cyclic sequence of application-layer messages in the composite sequence, and (iv) performing a security action using a representation of the first obscure cyclic sequence. In some examples, the composite sequence may include the first obscure cyclic sequence and a second obscure cyclic sequence of application-layer messages that were exchanged by the first computing device and the second computing device, and each message in the composite sequence may include a distinguishing feature. Various other methods, systems, and computer-readable media are also disclosed.