Targeted Attack Detection via Multi-Source Parameter Discrepancy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting man-in-the-middle attacks are ineffective in identifying targeted attacks on computer systems without imposing restrictions on user internet access, as they often rely on server-side encryption or avoiding open Wi-Fi networks, and fail to determine whether the user is interacting with a genuine or compromised resource.
Innovation Solution
A system and method that collect data from multiple computer systems and devices in a communications network to determine the possibility of a targeted attack by analyzing discrepancies in parameters such as IP addresses, DNS cache TTL, public key certificates, and geographic regions, and calculating the probability of an attack based on responses from various sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If server-side encryption and digital certificates are used to defend against man-in-the-middle attacks, then security against targeted attacks is improved, but dependence on the server and its encryption method increases, and users cannot verify if they are on the genuine server
Solution Approach 1:
Instead of relying solely on server-side verification, the patent inverts the approach by having multiple client systems verify the server's identity and report back. The defense mechanism shifts from server-centric to client-centric, where a group of client systems collectively verify the server's certificate and IP address, then report their findings to determine if a targeted attack is occurring.
Solution Approach 2:
The patent introduces an intermediary verification process where multiple client systems act as mediators between the user and the server. These client systems collect data about the server's credentials, compare them across multiple sources, and provide a collective verification that reduces dependence on any single server-side encryption method.
2Reliability
If total refusal to use open Wi-Fi networks is adopted to defend against attacks, then security against targeted attacks is improved, but user accessibility and ease of operation deteriorates
Solution Approach 1:
The system enables users to access open Wi-Fi networks without manual security configurations. The client systems automatically perform verification of server credentials, collect data from multiple sources, and determine attack probability without requiring user intervention or restriction of internet access.
Solution Approach 2:
The patent performs preliminary verification of server credentials before the user engages in sensitive transactions. By pre-collecting data from multiple client systems and calculating attack probability in advance, the system provides security protection without restricting user access to open networks.
3Measurement precision
If data is collected from multiple computer systems and devices to detect targeted attacks, then detection accuracy and reliability are improved, but system complexity and data processing requirements increase
Solution Approach 1:
The patent divides the verification task into segments performed by multiple independent client systems. Each client system collects specific data about the server's credentials independently, then the results are aggregated and analyzed collectively to determine attack probability, reducing the complexity burden on any single system.
Solution Approach 2:
The patent merges data from multiple client systems to achieve improved detection accuracy. By combining verification results from multiple independent sources and calculating collective attack probability, the system achieves higher measurement precision while distributing the processing complexity across multiple devices.
Data Source
AI summary
Disclosed are methods, systems, and computer programs for detecting targeted attacks on compromised computer from multiple sources. An example method includes obtaining data from multiple computer systems and devices connected with one another in a communications network to determine a possibility of a targeted attack from a network resource, the data comprising information relating to the network resource and a set of parameters of each computer system or device in accessing the network resource; detecting discrepancies in the obtained data; forming and sending queries to a group of computer systems and devices detecting the possibility of the targeted attack with the set of parameters of the group of computer systems and devices in accessing the network resource; and calculating a probability of the targeted attack from the network resource based at least upon information received from the group of computer systems and devices in response to the queries.