Anomaly Detection in Sinkholed Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing internal security controls in computer networks struggle to detect new types of malware whose signatures are similar to legitimate activities, and network anomaly detection solutions face challenges with high false positives and computational resource intensity in large environments.
Innovation Solution
An automated method and system that collect and analyze non-routable network packets to detect anomalies by aggregating and parsing network flow records, using machine learning to identify anomalous activity through feature vector analysis and threshold comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network anomaly detection solutions analyze all communications within the network, then malware detection capability is improved, but computational, memory, and storage resource requirements increase significantly
Solution Approach 1:
The patent extracts and analyzes only sinkholed traffic (packets routed to non-routable destinations) rather than all network communications. This selective extraction of relevant traffic reduces the volume of data requiring computational analysis while maintaining effective malware detection capability, as malicious activities often attempt connections to non-existent destinations.
Solution Approach 2:
The patent segments network traffic analysis by focusing specifically on sinkholed traffic flows rather than analyzing all network communications uniformly. This segmentation allows the system to concentrate computational resources on the most indicative malicious patterns while ignoring benign traffic, thereby reducing overall resource requirements.
2Measurement precision
If detection thresholds are increased to reduce false anomalies, then false positive rate decreases, but number of malware detected also decreases
Solution Approach 1:
The patent changes the parameters used for anomaly detection by analyzing specific characteristics of sinkholed traffic flows (such as connection patterns, destination diversity, and temporal behavior) rather than relying on fixed thresholds. This parameter transformation allows the system to maintain high detection sensitivity while reducing false positives through more nuanced analysis.
Solution Approach 2:
The system employs machine learning models that learn from historical sinkholed traffic patterns to dynamically adjust detection parameters. This feedback mechanism enables the system to distinguish between benign and malicious sinkholed traffic more accurately, maintaining high malware detection rates while reducing false positives through adaptive thresholding.
3Measurement precision
If signature-based security controls are used to detect known malware, then detection accuracy for known threats is improved, but new types of malware with signatures similar to legitimate activities cannot be detected
Solution Approach 1:
Instead of trying to identify malware by its malicious characteristics, the patent inverts the approach by analyzing sinkholed traffic patterns that result from both legitimate and malicious activities. By examining the behavior and patterns of traffic destined for non-routable addresses, the system can detect anomalies indicative of new malware without relying on known signatures, thus achieving both accuracy and adaptability.
Data Source
AI summary
An automated method for detecting anomalous activity in a private computer network comprises: collecting, over a current time period at an ingesting network device of the computer network, non-routable network packets routed to the ingesting network device from other network devices of the computer network; parsing the current collected network packets into corresponding current network flow records each including a source field and a destination field representing a non-routable network address; and for each distinct source identified in the source fields of the current network flow records: aggregating the current network flow records of that source into a current aggregated flow record; analyzing the current aggregated flow record using an anomaly detection module trained through machine learning on previous aggregated flow records of that source from previous time periods in order to detect anomalous activity in that source; and acting in response to detecting the anomalous activity in that source.