Threshold Lists for Worm Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in effectively detecting and blocking worm-generated scanning anomalies, which can lead to performance degradation and Denial-of-Service (DoS) attacks, as they struggle to set appropriate thresholds to minimize false positives and false negatives.
Innovation Solution
A network security system that employs a two-tiered threshold test to detect scanning anomalies by monitoring the number of unique destination addresses accessed by each source, using a threshold list to identify and block malicious traffic, and dynamically adjusts thresholds based on learned traffic patterns during both peacetime and attack conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single threshold is used to detect scanning anomalies, then the detection rule is simple, but it cannot effectively distinguish between low-rate worm propagation and legitimate traffic, leading to high false positive rates
Solution Approach 1:
The patent divides the detection system into two independent modules: a first module that monitors individual source-destination pairs and a second module that monitors the overall distribution of scanning traffic. Each module has its own threshold and detection logic, allowing them to operate independently and reduce false positives by segmenting the detection responsibilities.
Solution Approach 2:
The patent transitions from single-dimension threshold monitoring to two-dimensional threshold monitoring. The first threshold monitors the number of unique destination addresses per source, while the second threshold monitors the distribution pattern across multiple sources. This dimensional expansion enables more nuanced detection that distinguishes worm behavior from legitimate traffic.
2Reliability
If multiple thresholds and modules are used to improve detection accuracy, then false positives are reduced, but the system complexity increases
Solution Approach 1:
The patent divides the detection system into two independent modules: a first module that monitors individual source-destination pairs and a second module that monitors the overall distribution of scanning traffic. Each module has its own threshold and detection logic, allowing them to operate independently and reduce false positives by segmenting the detection responsibilities.
Solution Approach 2:
The patent introduces a distribution curve as an intermediary representation that bridges the two detection modules. The first module generates individual anomaly detections, which are then aggregated into a distribution curve that the second module analyzes. This intermediary structure organizes the complexity in a manageable way while maintaining detection accuracy.
3Ease of operation
If fixed thresholds are used for worm detection, then the detection logic is straightforward, but it cannot adapt to evolving worm strategies and traffic patterns
Solution Approach 1:
The patent implements dynamic thresholds that automatically adjust based on learned traffic patterns. The system continuously monitors network traffic and updates its thresholds to adapt to changing conditions, including new worm propagation strategies. This dynamic adjustment maintains detection effectiveness without requiring manual reconfiguration or complex decision logic.
Solution Approach 2:
The patent incorporates feedback mechanisms where the detection system continuously monitors traffic patterns and uses this information to adjust its thresholds. The system learns from observed traffic and worm behavior, feeding this information back into the threshold adjustment process to improve detection accuracy over time while maintaining operational simplicity.
Data Source
AI summary
A computer-implemented method is provided for screening communication traffic. A list of one or more threshold pairs including respective first and second threshold values, each of which first threshold values is greater than one, are defined. Network traffic from a plurality of sources is monitored, so as to determine for each source a count of unique destination addresses to which the source transmitted data during a period of time. A response to malicious network traffic is invoked responsively to finding that each of a first number of the sources sent data to at least a second number of the destination addresses, wherein, for at least one of the threshold pairs, the first number is at least equal to the respective first threshold value, and the second number is at least equal to the respective second threshold value.