Wireless Access Switch Malware Detection via PDU Header Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are ineffective in wireless networks, as they cannot differentiate between clients sharing a common switch port and require complex processing or dedicated switches, making it difficult to identify and contain infected clients without causing false positives.
Innovation Solution
A method and system that examines header data of protocol data units (PDUs) in a wireless access switch to determine client MAC addresses and maintain counters for each client, using a limits table and rules set to identify and contain malware by classifying PDU types and performing mathematical computations to detect suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based methods are used for malware detection, then detection capability is provided, but the methods are largely ineffective against flash worms and require costly and tedious updates
Solution Approach 1:
The patent changes the detection parameter from static signature matching to dynamic traffic anomaly detection. Instead of relying on predefined virus signatures that require constant updates, the system monitors real-time network traffic patterns, packet rates, and protocol behavior to detect worms like Code Red and Nimda. This parameter change makes the system automatically adaptive to new threats without requiring manual signature updates.
2Speed
If conventional traffic anomaly solutions are used, then quick detection capabilities are provided, but complex processing cannot be done at the fast data-path and require stand-alone switches
Solution Approach 1:
The patent merges the traffic anomaly detection function directly into the fast data-path of the network switch. The anomaly detection unit is integrated with the switch's existing packet forwarding infrastructure, allowing complex processing of traffic patterns to occur at line rate without requiring separate stand-alone switches. This integration enables quick detection while utilizing the switch's existing hardware resources for packet classification and counting.
3Measurement precision
If port-based detection is used in wireless networks, then malware identification is provided, but the solution is not suited for wireless networks where multiple clients share a common switch port
Solution Approach 1:
The patent adds another dimension to client identification by using MAC addresses as a secondary identification layer beyond the shared switch port. In wireless networks where multiple clients connect through a common access point, the system now tracks traffic anomalies per-MAC-address rather than just per-port. This dimensional extension allows precise identification of infected clients (e.g., specific laptop or phone) while maintaining adaptability to the shared medium nature of wireless networks.
Data Source
AI summary
Malware detection systems and methods are presented in which header data of protocol data units (PDUs) are examined at a wireless access switch shared by multiple clients, and the PDU type and client are used to establish counters, with the count values being analyzed to identify clients suspected of being infected with malware.