User Identifier Association for Network Malicious Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to effectively associate user identifiers detected from web traffic with client addresses, particularly in identifying malicious behavior in networks with new types of malware and zero-day attacks.
Innovation Solution
A method that involves receiving known user identifiers and web traffic log data in a network, detecting user identifiers in the header information of web traffic, and associating these identifiers with client addresses to enhance malicious behavior detection systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral analytics is used to identify malicious conditions in the network, then the ability to detect new types of malware and zero-day attacks is improved, but the complexity of the security system increases
Solution Approach 1:
The system segments the security analysis function into two distinct components: a behavioral analytics engine that performs complex pattern recognition and anomaly detection, and a rule-based response system that executes predefined security actions. This segmentation allows the complex detection functionality to be isolated from the simpler response mechanisms, improving overall system reliability while managing complexity through functional separation.
Solution Approach 2:
The patent introduces an intermediary layer that translates complex behavioral analytics findings into actionable security responses. This intermediary component processes the output of behavioral analytics and converts it into standardized formats that can be consumed by response systems, thereby bridging the gap between complex detection capabilities and simpler response mechanisms.
2Measurement precision
If user identifiers are associated with client addresses through web traffic analysis, then the precision of malicious behavior identification is improved, but the amount of data processing required increases
Solution Approach 1:
The system performs preliminary association of user identifiers with client addresses during normal web traffic analysis before malicious behavior detection is needed. By pre-establishing these associations during routine operations, the system avoids the need for intensive real-time processing when security threats are detected, thereby improving identification precision while reducing the data processing load during critical security events.
Solution Approach 2:
The patent creates copies of user identifier and client address associations and stores them in accessible memory structures. These copied associations can be quickly retrieved and matched during security analysis without requiring re-processing of the original web traffic data, significantly reducing the computational energy required for identification while maintaining high precision.
Data Source
AI summary
In one embodiment, a device in a network receives a set of known user identifiers used in the network. The device receives web traffic log data regarding web traffic in the network. The web traffic log data includes header information captured from the web traffic and a plurality of client addresses associated with the web traffic. The device detects a particular one of the set of known user identifiers in the header information captured from the web traffic associated with a particular one of the plurality of client addresses. The device makes an association between the particular detected user identifier and the particular client address.