Targeted Network Threat Detection via Pre-computed Traffic Characteristics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in quickly detecting newly discovered malware due to the need for extensive upgrades and analysis, which can leave networks exposed for significant periods before solutions can be implemented, especially when dealing with polymorphic infections.
Innovation Solution
The development of rapid, targeted network threat detection methods that generate and deploy detectors based on a small sample of the threat and pre-computed characteristics of background traffic, allowing for quick identification and blocking of malicious traffic without requiring extensive data analysis or machine learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems are upgraded to detect new malware, then detection capability is improved, but implementation time is extended
Solution Approach 1:
The system pre-computes statistical measures and characteristics of background network traffic in advance, so that when new malware is detected, the detector can be rapidly deployed without waiting for extensive background analysis. This preliminary preparation resolves the contradiction by making the detection system ready before actual threats appear.
Solution Approach 2:
The detection system is segmented into a general background traffic model (pre-computed) and specific threat detectors (deployed on-demand). This segmentation allows the system to maintain fast response for new threats while using pre-computed general characteristics, resolving the time-capability contradiction.
2Reliability
If comprehensive malware detection is implemented, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system extracts only the essential statistical characteristics and patterns from background traffic, separating them from the complexity of full network analysis. This extraction creates a simplified detector that maintains accuracy while reducing system complexity.
Solution Approach 2:
The system transforms complex network traffic into statistical parameters and characteristics that can be efficiently processed. By changing the representation from raw traffic data to statistical measures, the system achieves detection accuracy without proportionally increasing complexity.
3Speed
If rapid detector deployment is achieved, then response time is improved, but detection precision may deteriorate
Solution Approach 1:
By pre-computing background traffic characteristics and statistical measures, the system enables rapid detector deployment without sacrificing precision. The preliminary analysis ensures that detectors are built on solid foundational data, maintaining precision while achieving speed.
Solution Approach 2:
The system creates detectors by copying and adapting pre-computed background characteristics rather than analyzing each threat from scratch. This copying approach enables rapid deployment while maintaining precision through reuse of validated statistical models.
Data Source
AI summary
Rapidly detecting network threats with targeted detectors includes, at a computing device having connectivity to a network, determining features of background network traffic. Features are also extracted from a particular type of network threat. A characteristic of the particular type of network threat that best differentiates the features of the particular type of network threat from the features of the background network traffic is determined. A targeted detector for the particular type of network threat is created based on the characteristic and an action is applied to particular incoming network traffic identified by the targeted detector as being associated with the particular type of network threat.