Variance-Based Detection of Systematic Network Communications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network-security monitoring platforms (NSMPs) face challenges in detecting systematic, repetitive, and periodic communications that may indicate the presence of malware, as existing methods often rely on deterministic or probabilistic approaches that are not effective in identifying low-latency and periodic malicious behavior.
Innovation Solution
A method and corresponding SNMP that calculates a variance value for data packet communications by analyzing metadata, including source and destination addresses and sending times, to identify systematic communications, using an iterative approach to manage timestamp sequences and determine variance, thereby generating notifications for potential malware activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deterministic or probabilistic approaches are used for detecting malware communications, then the monitoring system can operate with simpler algorithms, but the detection effectiveness for systematic and periodic malicious behavior is insufficient
Solution Approach 1:
The patent transforms the detection approach by changing the parameter being analyzed from simple presence/absence to statistical variance of inter-packet time intervals. By calculating variance of timing parameters, the system can detect systematic periodic communications characteristic of malware while maintaining operational feasibility.
Solution Approach 2:
The patent replaces deterministic detection mechanisms with statistical analysis methods. Instead of using fixed rules or simple probability thresholds, the system employs variance calculation on inter-packet timing data to identify systematic patterns, substituting mechanical detection logic with statistical inference.
2Measurement precision
If traditional monitoring methods are used, then the system structure remains simple, but the ability to identify low-latency and periodic malicious behavior is compromised
Solution Approach 1:
The patent enhances measurement precision by shifting from analyzing single packet attributes to calculating statistical variance of inter-packet time intervals. This parameter transformation enables precise detection of periodic behavior while keeping the monitoring system architecture relatively simple.
Solution Approach 2:
The system performs preliminary calculations of inter-packet time intervals and their variances as packets are received, rather than performing complex analysis after data collection. This preliminary statistical processing enables real-time detection precision without requiring complex post-processing systems.
3Reliability
If variance calculation is performed on all data packets, then detection accuracy improves, but computational resources and processing time increase
Solution Approach 1:
The patent applies variance calculation selectively to identify systematic communications rather than treating all packets uniformly. By focusing computational resources on calculating variance for packets that exhibit systematic timing patterns, the system improves detection reliability while minimizing unnecessary processing time for normal traffic.
Solution Approach 2:
The system performs variance calculation as a partial action - not on every single packet in the network, but specifically on sequences of packets from the same source to detect systematic behavior. This partial application of the computationally intensive variance calculation maintains reliability for malware detection while reducing overall processing time and resource consumption.
Data Source
AI summary
Described herein is a method for detecting systematic communications in a communications network (10, 30). The method comprises repeating the following steps for each data packet (DP) of a sequence of a plurality of data packets (DP) sent through the communication network (10, 30) from a respective source to a respective destination:obtaining (1002, 1004) metadata (MD) of the data packet (DP), wherein the metadata (MD) include both data that identify the source and/or the destination and data that identify a sending time (t) when the data packet (DP) has been sent;verifying (1022) whether the data packet (DP) belongs to a specific type of communication by checking whether the metadata (MD) indicate the fact that the data packet (DP) has been sent by a given source and/or received by a given destination, and in the case where the metadata (MD) indicate that the data packet (DP) has been sent by a given source and/or is received by a given destination, computing (1024) a value of variance for the given type of communication; andcomparing (1012) the value of variance with a threshold (TH), and in the case where the value of variance is less than the threshold, generating (1014) a notification that indicates the fact that the given type of communication is systematic.In particular, the value of variance is calculated by means of an iterative procedure.