Automatic Trojan Signature Generation via HTTP Packet Centroids
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face challenges in detecting zero-day attacks and keeping pace with the rapidly evolving malware landscape, as they rely on manually written signatures that are time-consuming to develop and often fail to detect new variants of malware effectively.
Innovation Solution
A method for automatically generating Trojan signatures by acquiring HTTP session packets, identifying suspicious request packets, grouping them into subsets, computing centroids, and generating representative signatures that can be deployed by intrusion detection systems to detect known Trojans and their variants with low latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manually written signatures are used for malware detection, then detection accuracy for known malware is maintained, but the time required for signature development increases and new variants are not detected effectively
Solution Approach 1:
The system automatically generates malware signatures by analyzing malicious packets and extracting characteristic patterns without human intervention. The signature generation process is self-service, where the system independently identifies suspicious packets, extracts features, and creates detection signatures that are then deployed to detect similar malware variants.
Solution Approach 2:
The system performs preliminary analysis of malicious traffic by acquiring and analyzing suspicious packets before formal signature deployment. By pre-processing malicious packets and extracting their characteristic features in advance, the system prepares detection signatures proactively, enabling rapid response to new malware variants before they spread widely.
2Reliability
If manually written signatures are used for malware detection, then existing malware can be detected, but the ability to detect new variants and zero-day attacks deteriorates
Solution Approach 1:
The system continuously adapts to new malware variants through automatic signature generation. By self-service analysis of newly encountered malicious packets and automated extraction of variant-specific features, the system dynamically updates its detection capabilities to recognize emerging threats without requiring manual reconfiguration.
Solution Approach 2:
The detection system transitions from static manually-written signatures to dynamic automatically-generated signatures that adapt to new malware variants. The system continuously evolves its signature set by analyzing new malicious traffic patterns, making the detection capability flexible and responsive to changing threat landscapes.
3Measurement precision
If traditional malware analysis methods are used, then thorough detection is achieved, but the processing speed and latency increase
Solution Approach 1:
The system extracts only the essential characteristic features from malicious packets that are necessary for detection, rather than performing exhaustive analysis of entire malware samples. By extracting key identifying patterns such as specific packet structures, payloads, or communication behaviors, the system achieves thorough detection with reduced processing overhead and lower latency.
Solution Approach 2:
The detection process is segmented into distinct stages: acquiring suspicious packets, extracting relevant features, generating signatures, and deploying detection rules. This segmentation allows parallel processing of different packet batches and optimizes the workflow to minimize overall detection latency while maintaining thoroughness.
Data Source
AI summary
A method includes acquiring a plurality of hypertext transfer protocol (HTTP) session packets associated with activities of a plurality of known Trojans, wherein all of the Trojans are identified by a common signature identifier, extracting a plurality of request packets from the session packets, identifying a plurality of suspicious request packets within the plurality of request packets, grouping the plurality of suspicious request packets into a plurality of subsets, computing a centroid of one subset of the plurality of subsets, identifying a representative packet for the subset, wherein the representative packet is identified based on the centroid, and generating a signature for the one subset, based on the representative packet, wherein the signature is deployable by an intrusion detection system to detect an instance of a Trojan of the plurality of known Trojans.