TCP Session Threat Detection via Packet Timing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to effectively detect port recall Trojan horses, which evade detection by establishing reverse connections through standard network ports, compromising network security.
Innovation Solution
A threat detection method that analyzes TCP sessions by calculating activation rates, response rates, and interaction quantities based on packet time information, identifying reverse connections and determining threat levels through heartbeat message and encryption detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall restricts connections from external network to protected network strictly, then network security is improved, but port recall Trojan horses can evade detection by establishing reverse connections
Solution Approach 1:
The patent inverts the traditional detection approach by not looking for incoming connections (which firewalls block) but rather analyzing outgoing connections from protected devices. Instead of checking if external devices can connect to internal devices, the system monitors whether internal devices initiate connections to external devices, which is the reverse of normal traffic patterns and characteristic of port recall Trojan horses.
Solution Approach 2:
The patent implements feedback mechanisms by continuously monitoring TCP session characteristics including packet timing, activation rates, response rates, and interaction quantities. The system compares observed connection patterns against established thresholds and provides feedback when anomalous patterns are detected, enabling dynamic adjustment of security responses based on real-time analysis of connection behavior.
2Ease of operation
If conventional detection methods are used, then detection simplicity is maintained, but port recall Trojan horses cannot be effectively detected
Solution Approach 1:
The patent changes the parameters being monitored from simple connection presence/absence to detailed temporal and behavioral parameters including packet timing intervals, activation rates, response rates, and interaction quantities. By analyzing these changed parameters, the system can distinguish between normal outbound traffic and port recall Trojan horse connections while maintaining automated operation through threshold-based detection.
3Adaptability or versatility
If the first device proactively initiates TCP session to second device, then reverse connection is established for Trojan horse operation, but this creates detectable anomaly in connection pattern
Solution Approach 1:
The patent performs preliminary analysis of connection patterns by establishing baseline thresholds for activation rates, response rates, and interaction quantities before actual threat detection. These preliminary parameters are used to classify connection modes, enabling the system to identify reverse connections characteristic of port recall Trojan horses by comparing observed patterns against pre-established criteria for normal versus anomalous behavior.
Data Source
AI summary
A threat detection method includes: obtaining packets in a Transmission Control Protocol (TCP) session between a first device and a second device; obtaining a first data flow transmitted from the first device and a second data flow transmitted from the second device in the TCP session; obtaining time information of each of a plurality of first packets in the first data flow and time information of each of a plurality of second packets in the second data flow; calculating an activation rate, a response rate, and a quantity of interactions based on the time information; and if the activation rate is greater than or equal to a first threshold, the response rate is greater than or equal to a second threshold, and the quantity of interactions is greater than or equal to a third threshold, determining that the first device is threatened.