Two-Level Traffic Tunneling for Peer-to-Peer Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection technologies face challenges in emulating a network environment at a sufficient level of complexity to evade detection by cybercriminals, particularly when using virtual private networks (VPNs) which are resource-intensive and have client-server architectures, and traffic tunneling methods require central servers that are costly and inefficient.
Innovation Solution
Implementing a two-level tunneling system using WireGuard and GRE levels for direct peer-to-peer traffic transmission between emitters and gateways, bypassing central servers, with natting and denatting processes to ensure secure and efficient malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If VPN is used for traffic tunneling in distributed network, then network environment emulation complexity is improved, but resource consumption increases
Solution Approach 1:
The patent segments the tunneling functionality into two distinct levels: WireGuard level for secure peer-to-peer communication and GRE level for network protocol encapsulation. This segmentation allows each layer to perform its specific function efficiently, avoiding the resource-intensive client-server architecture of traditional VPNs while maintaining the necessary network environment complexity for malware detection.
Solution Approach 2:
The patent introduces a peer-to-peer communication mechanism as an intermediary between emitters and gateways, replacing the central server-mediated communication of traditional VPNs. This intermediary approach enables direct communication paths that reduce resource consumption while maintaining the ability to emulate complex network environments through the two-level tunneling architecture.
2Device complexity
If central server is used for traffic tunneling, then network environment emulation is improved, but system cost and efficiency worsen
Solution Approach 1:
The patent inverts the traditional client-server model by implementing a peer-to-peer architecture where emitters and gateways communicate directly without requiring a central server. This inversion eliminates the single point of failure and bottleneck that reduces system efficiency, while the two-level tunneling (WireGuard + GRE) maintains the necessary network environment emulation capabilities.
3Ease of operation
If simple NAT technique is used, then IP address masking is improved, but network communication reliability worsens
Solution Approach 1:
The patent implements nested encapsulation where GRE protocol packets are encapsulated within WireGuard protocol packets. This nested structure allows the system to perform simple NAT operations at each layer while maintaining communication reliability through the multi-layered architecture. The WireGuard layer provides reliable peer-to-peer communication, while the GRE layer provides additional encapsulation for network protocol simulation, together ensuring both ease of operation and reliability.
Data Source
AI summary
A method and an electronic device for traffic tunneling in a distributed network for detecting malicious content are provided. The method comprises: transmitting, to a central server, a request for receiving a gateway data from a given gateway; in response to receiving the gateway data, adding the given gateway as a peer to a WireGuard interface of an electronic device; transmitting, to the central server, an Address Resolution Protocol (ARP) probe which is indicative of whether the electronic device is ready to establish a p2p connection with the given gateway; in response to receiving a response to the ARP probe, updating the gateway data in a neighbor table hosted on the given emitter; transmitting an outgoing traffic packet to the given gateway for natting; in response to receiving, from the given gateway, an incoming traffic packet, analyzing a content of the incoming traffic packet for maliciousness.