Network Breach Detection via Trust Profile Behavior Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network security methods relying on malware signatures are resource-intensive, inaccurate, and ineffective in detecting evolving malware, leading to false negatives and false positives, and fail to protect networks from infections spread by mobile devices.
Innovation Solution
Monitoring network devices for behavior consistent with legitimate tasks using trust profiles, which define permissible ports and protocols, allowing for real-time analysis and proactive detection of untrustworthy actions, thereby reducing computational resources and improving security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware signature-based detection is used, then known threats can be identified and removed, but the system cannot detect evolving malware and generates false negatives
Solution Approach 1:
Instead of detecting malware by comparing against known malicious signatures, the system inverts the approach by monitoring for deviations from legitimate behavior patterns. Trust profiles establish what normal device actions should look like, and any divergence from these profiles indicates potential malware activity, regardless of whether the malware is known or evolving.
Solution Approach 2:
The system performs preliminary action by proactively establishing trust profiles that define expected legitimate behavior before malware can execute. By pre-defining what normal device operations should entail, the system is prepared to immediately detect anomalies when malware attempts to operate, rather than waiting for signature updates.
2Reliability
If malware signatures are generated and maintained, then threat detection capability is provided, but significant computing resources and engineering effort are consumed
Solution Approach 1:
Instead of creating and maintaining complex malware signatures through resource-intensive analysis, the system creates simplified trust profiles that copy only the essential characteristics of legitimate device behavior. These lightweight profiles require minimal computational resources to generate and maintain, yet effectively enable anomaly detection.
Solution Approach 2:
The trust profiles serve as disposable, low-cost alternatives to expensive malware signatures. Rather than investing significant engineering effort into creating and updating sophisticated signature databases, the system uses simple, easily generated behavior profiles that can be quickly created and discarded or updated as needed.
3Reliability
If client-level monitoring is applied to screen all traffic for malware signatures, then threat detection is performed, but false-positive detections consume additional computing resources
Solution Approach 1:
The system converts the potential harm of false positives into a benefit by using trust profile violations as the detection mechanism. Rather than flagging traffic that matches known malware patterns (which causes false positives), the system only flags traffic that deviates from established legitimate behavior patterns, turning the absence of anomalies into a positive security indicator.
4Reliability
If signature-based security protocols are used, then network protection is provided, but mobile devices can still transmit infections to other systems upon reconnection
Solution Approach 1:
The trust profile system provides universal protection that works across multiple networks and device contexts. Unlike signature-based systems that are network-specific and require separate signature databases for different environments, trust profiles establish device-level behavior baselines that remain valid regardless of which network the device connects to, enabling consistent security protection across diverse environments.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Actions of servers and other network devices within a network are monitored to detect whether the servers and network devices are performing tasks, using protocols, and communicating through ports that are consistent with legitimate (or "permissible") purposes. That is, rather than attempting to belatedly identify malware signatures and screen all traffic into and out of a network for these signatures, embodiments of the present invention scrutinize devices (such as servers and other network infrastructure elements) for malware behavior that is inconsistent with an identified set of actions known to be consistent with legitimate tasks performed by the network device.