Access Switch Malware Detection via PDU Header Fan-Out Trends
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware, particularly stealthy worms, in wireless local area networks (WLANs) are inadequate, as they struggle to effectively identify slow scanning malware due to low detection thresholds and shared access points, leading to network congestion and shutdowns.
Innovation Solution
A method and apparatus that examine header data in protocol data units (PDUs) to identify far-end device addresses, maintain fan-out information, determine trends, and compare them to expected trends to detect suspected malware infections by using a header data processing unit, data storage logic, and malware identification logic within an access switch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used in shared access point networks, then detection simplicity is maintained, but detection precision deteriorates due to inability to distinguish malware traffic from legitimate traffic in shared environments
Solution Approach 1:
The patent segments the detection process into distinct functional modules: header data processing unit for extracting packet headers, data storage logic for maintaining fan-out information, data processing logic for trend analysis, and malware identification logic for detection. This segmentation allows each module to perform a specific function efficiently, improving detection precision while managing system complexity through modular design.
Solution Approach 2:
The patent introduces an intermediary approach by using fan-out information as a mediator between raw packet data and malware detection. Instead of directly analyzing packet contents, the system measures the fan-out (number of unique destination addresses) as an intermediate metric that indirectly indicates malware activity, thereby improving detection precision without requiring complex deep packet inspection.
2Measurement precision
If detection thresholds are lowered to detect stealthy worms, then detection sensitivity improves, but false alarm rate increases due to normal traffic variations
Solution Approach 1:
The patent implements dynamic thresholding by comparing current fan-out trends against expected trends derived from historical data, rather than using fixed thresholds. The malware identification logic dynamically adjusts detection criteria based on the ratio of current to expected fan-out values, allowing the system to adapt to normal traffic variations while maintaining sensitivity to stealthy worm activity, thereby reducing false alarms.
Solution Approach 2:
The system uses feedback mechanisms by continuously monitoring fan-out information over multiple time windows and comparing actual values against expected values. The data processing logic analyzes trends in fan-out data and provides feedback to the malware identification logic, which adjusts detection decisions based on this feedback, improving reliability by distinguishing between normal fluctuations and actual malware activity.
3Measurement precision
If header data examination is performed on all PDUs, then malware detection capability improves, but processing speed deteriorates due to high volume of network traffic
Solution Approach 1:
The patent extracts only the necessary header data from protocol data units without performing full packet inspection. The header data processing unit selectively extracts relevant fields (such as source and destination addresses) from packet headers to calculate fan-out information, thereby maintaining malware detection capability while significantly reducing processing overhead and maintaining high packet processing speed.
Solution Approach 2:
The system performs partial action by examining only the header portion of packets rather than complete packet contents. This partial inspection approach provides sufficient information for fan-out calculation and malware detection while avoiding the excessive processing burden of full packet analysis, thus maintaining both detection capability and processing speed.
Data Source
AI summary
A method of detecting malware may include: a) examining header data in each PDU transferred by a port of an access switch to identify PDUs transferred from a local network device, b) extracting a far-end device address for PDUs based at least in part on examination of an address portion of the corresponding header data, c) maintaining fan-out information indicative of a quantity of unique far-end device addresses extracted from the PDUs during consecutive time windows, d) determining a current trend based on the fan-out information for a current time window, e) comparing the current trend to an expected trend, and f) identifying a suspected malware infection in the local network device when the current trend exceeds the expected trend by a trend threshold. A network element that may implement the method may include a header data processing unit, data storage logic, data processing logic, and malware identification logic.