Spam Zombie Detection via Sequential Probability Ratio Test
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures are ineffective in detecting compromised machines in networks, particularly those used for spamming, as they rely on aggregate global characteristics and cannot support online detection requirements, and current methods fail to identify all types of compromised machines involved in spamming.
Innovation Solution
A spam zombie detection system that monitors outgoing email messages using a Sequential Probability Ratio Test (SPRT) to classify messages as spam or non-spam, updating a probability ratio to determine if a machine is compromised, with the ability to be co-located with mail transfer agents or separate, and using user-defined thresholds to control false positive and false negative rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security measures rely on aggregate global characteristics of spamming botnets, then they can understand overall spamming patterns, but they cannot support online detection requirements and cannot identify all types of compromised machines
Solution Approach 1:
The patent segments the detection task by focusing on individual machine behavior patterns rather than aggregate global characteristics. It monitors specific outbound communication patterns from each host, analyzing sequences of actions (e.g., scanning, exploit attempts, data exfiltration) to identify compromised machines. This segmentation enables online detection while maintaining precision.
Solution Approach 2:
The system performs preliminary analysis of communication patterns by establishing baseline behavior models for legitimate hosts and pre-identifying suspicious sequences of actions. By preparing detection rules and pattern signatures in advance, the system can quickly identify compromised machines without requiring real-time aggregate analysis, thus achieving both speed and precision.
2Adaptability or versatility
If current methods monitor aggregate spam characteristics, then they can detect spamming activities at a global level, but they fail to identify all types of compromised machines involved in spamming
Solution Approach 1:
The patent applies local quality by analyzing the specific behavior characteristics of individual hosts rather than relying on global aggregate statistics. It monitors local outbound communication patterns, including connection sequences, data transfer characteristics, and interaction with specific destinations, to accurately identify compromised machines regardless of their role in the spamming operation.
Solution Approach 2:
The detection system achieves universality by designing a unified monitoring framework that can identify multiple types of compromised machines (e.g., spam relays, botnet controllers, infected hosts) through a common set of behavioral analysis techniques. The system adapts to different spamming methodologies by learning from observed patterns rather than relying on fixed signatures, thereby expanding detection coverage while maintaining accuracy.
3Measurement precision
If the system monitors all outgoing messages to detect compromised machines, then detection accuracy improves, but the complexity and resource consumption increase
Solution Approach 1:
The patent extracts only the critical information needed for detection from the full message stream. Instead of analyzing every outgoing message in detail, it extracts specific behavioral indicators such as connection patterns, protocol anomalies, and communication sequences. This extraction approach maintains detection accuracy while significantly reducing processing complexity and resource consumption.
Solution Approach 2:
The system applies partial action by monitoring only the most indicative aspects of host behavior rather than all possible message characteristics. It focuses on key behavioral markers (e.g., repeated connection attempts, data exfiltration patterns) that are sufficient for identification, avoiding the need to analyze every detail of outgoing communications. This selective monitoring achieves adequate accuracy without excessive complexity.
Data Source
AI summary
A method of detecting a compromised machine on a network. The method receives an email message from a machine on the network and classifies it as either spam or non-spam. A probability ratio is then updated, according to whether the message was spam or non-spam, by applying a sequential probability ratio test. If the probability ratio is greater than or equal to a first threshold, then the machine is compromised. If the probability ratio is less than or equal to a second threshold, then the machine is normal. The operations of receiving a message, classifying the message, updating the probability ratio, and indicating the machine is normal or compromised until the probability ratio is greater than or equal to the first threshold are repeated for a plurality of messages. Such repeated operations are performed on each of the messages one at a time, as each of the messages is received.