Detecting Stealth Malware via Inbound Outbound Traffic Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems for network devices, such as routers and firewalls, are inadequate in identifying stealth malware infections, as they rely on signature-based solutions and cannot detect unauthorized or modified packets without known signatures, especially when network devices are compromised.
Innovation Solution
A system that compares inbound and outbound network traffic to detect unauthorized packets and modified payloads by using network taps to monitor traffic and a server module that generates alerts for discrepancies, and also receives configuration profiles and known network traffic reports to identify stealth network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based intrusion detection systems are used to detect malware on network devices, then detection capability for known malware is improved, but detection capability for novel or stealth malware is worsened
Solution Approach 1:
Instead of analyzing outgoing packets for malware signatures, the system inverts the approach by examining incoming packets to determine if they should legitimately exist. By verifying that every incoming packet has a corresponding outgoing request, the system can detect stealth malware that attempts to masquerade as legitimate traffic, regardless of whether it matches known signatures.
2Measurement precision
If network devices are examined directly to detect malware infections, then detection precision is improved, but detection feasibility is worsened due to closed systems
Solution Approach 1:
The system uses network traffic packets as an intermediary to detect malware infections on closed network devices. Instead of attempting to directly examine or access the closed device systems, the monitor server analyzes incoming and outgoing packets to infer the presence of malware, thereby maintaining detection precision while overcoming the inaccessibility of closed systems.
3Reliability
If comprehensive network traffic monitoring is implemented to detect all unauthorized packets, then detection completeness is improved, but system complexity is worsened
Solution Approach 1:
The system extracts only the essential information needed for detection: incoming packets and their corresponding outgoing requests. By focusing solely on this critical subset of network traffic data rather than monitoring all possible network parameters, the system achieves comprehensive detection completeness while maintaining relatively simple system architecture and operation.
Data Source
AI summary
The present invention generally relates to detecting malicious network activity coming from network devices such as routers and firewalls. Specifically, embodiments of the present invention provide for detecting stealth malware on a network device by comparing inbound and outbound network traffic to discover packets originating from the network device and packets that violate configuration rules. When combined with a network traffic monitor server configured to monitor actual network traffic reports and to receive known network traffic reports from host computers, the system can detect stealth network traffic originating from both network devices and host computer systems.