Network Traffic Image Analysis for Adaptive Botnet Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing detection mechanisms for Botnet traffic are inefficient due to the need for extensive manual analysis by security experts and struggle to adapt to changing malware behaviors, making it difficult to trace relay stations and detect malicious activities effectively.

Innovation Solution

An abnormal traffic detection method that utilizes a sampling window to analyze network traffic data through image processing and deep learning, automatically identifying abnormal traffic patterns and risk levels using neural networks, reducing the reliance on manual expert analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If manual analysis by security experts is used to detect Botnet traffic, then detection accuracy can be maintained for known patterns, but detection efficiency decreases and the system cannot adapt to changing malware behaviors

Engineering Contradiction:
Improvedetection efficiencyVSAvoidadaptability to changing malware behaviors
Core Design Contradiction:
ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent replaces manual mechanical analysis by security experts with an automated image processing system. Network traffic data is converted into images using visualization techniques, and deep learning models automatically analyze these images to detect abnormal traffic patterns, eliminating the need for manual feature analysis while maintaining high detection accuracy and adaptability to new malware behaviors

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent transforms network traffic parameters into visual image parameters. Traffic data such as packet sizes, timestamps, and protocol information are converted into image attributes like pixel intensity, color, and spatial distribution. This parameter transformation enables the use of deep learning models that can automatically adapt to changing malware behaviors through training on visual patterns rather than requiring manual rule updates

Inventive Principle:
Principle #35Parameter changes

2Measurement precision

If feature analysis and classification on mass data is performed by security experts, then detection precision for known malware can be maintained, but the system cannot catch up with feature changes of malware in actual use

Engineering Contradiction:
Improvedetection precisionVSAvoidability to catch up with malware feature changes
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system performs self-service through automatic learning and adaptation. The deep learning model continuously trains on new network traffic data, automatically learning patterns of emerging malware behaviors without requiring human intervention. The model self-adjusts its feature extraction and classification capabilities to keep pace with malware evolution, maintaining high detection precision while adapting to new threats

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The patent implements feedback mechanisms where detection results and newly identified malware patterns are fed back into the system for retraining. This feedback loop enables the model to continuously improve its detection precision and adapt to changing malware features, creating a dynamic system that evolves alongside threat actors

Inventive Principle:
Principle #23Feedback

3Productivity

If automated image analysis is used to detect abnormal traffic, then detection efficiency is improved, but the complexity of the detection system increases

Engineering Contradiction:
Improvedetection efficiencyVSAvoidsystem complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent segments the detection system into distinct functional modules: data collection module, image visualization module, deep learning analysis module, and result output module. Each module handles a specific aspect of the detection process independently, making the overall complex system more manageable and easier to implement. The segmentation allows for modular development and easier maintenance while maintaining high detection efficiency

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP3817328B1Abnormal traffic detection method and abnormal traffic detection device
Publication Date: 2025.12.03 ACER CYBER SECURITY INC
  • EP3817328B1 patent drawingFigure 1~2
  • EP3817328B1 patent drawingFigure 3~4
  • EP3817328B1 patent drawingFigure 5~6

AI summary

An abnormal traffic detection method is provided according to an embodiment of the disclosure. The method includes: obtaining network traffic data (21, 22, 31, 81) of a target device (12); sampling the network traffic data (21, 22, 31, 81) by a sampling window (301, 302, 303) with a time length to obtain sampling data (401, 402, 403, 411, 412, 413, 51, 52, 801(1), 801(2), 801(3), 802(1), 802(2), 802(3), 802(4), 803(1)); generating, according to the sampling data (401, 402, 403, 411, 412, 413, 51, 52, 801(1), 801(2), 801(3), 802(1), 802(2), 802(3), 802(4), 803(1)), an image (71) which presents a traffic feature of the network traffic data (21, 22, 31, 81) corresponding to the time length; and analyzing the image (71) to generate evaluation information (91) corresponding to an abnormal traffic. In addition, an abnormal traffic detection device (10) is also provided.