VPC Beacon Detection Using Unsupervised Traffic Flow Models

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing virtual private clouds (VPCs) are susceptible to malicious beaconing activities that evade detection by blending with normal network traffic and varying their timing and packet size, posing a threat to organizational infrastructure.

Innovation Solution

A system employing unsupervised machine learning models is used to detect malicious beaconing activities in VPCs by monitoring network traffic, leveraging statistical features of simulated and known beacons, and updating filters in real-time to identify potential threats, with user feedback for model refinement.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional monitoring methods are used to detect malicious beaconing, then detection coverage is limited, but resource consumption and computational overhead increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidresource consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system pre-computes and stores statistical baselines for normal beaconing behavior patterns before actual detection occurs. These pre-established baselines enable rapid comparison against incoming traffic without requiring intensive real-time computation, thereby improving detection accuracy while minimizing resource consumption during operational monitoring.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional rule-based and signature-based detection mechanisms with machine learning models that automatically learn and adapt to beaconing patterns. This substitution eliminates the need for manual rule configuration and reduces computational overhead by leveraging trained models that make predictions without requiring exhaustive analysis of each traffic flow.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If machine learning models are applied to detect beaconing activities, then detection capability improves, but system complexity increases

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The machine learning detection system is divided into distinct modular components: feature extraction modules that analyze specific traffic attributes, model training modules that learn from historical data, and prediction modules that apply trained models to new traffic. Each module performs a specialized function, making the overall complex system manageable, maintainable, and scalable while preserving high detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces intermediary components such as feature extraction layers that transform raw network traffic into standardized inputs suitable for machine learning models, and prediction layers that translate model outputs into actionable detection results. These intermediaries simplify the integration between diverse data sources and detection algorithms, reducing system complexity while maintaining reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If real-time monitoring of network traffic is performed, then beaconing detection is improved, but computational overhead increases

Engineering Contradiction:

Improvedetection speedVSAvoidcomputational overhead

Core Design Contradiction:

ProductivityVSLoss of energy

Solution Approach 1:

The system applies partial monitoring by focusing computational resources on analyzing only the most suspicious or anomalous traffic patterns rather than examining every packet in detail. Machine learning models identify and flag only those flows that exhibit characteristics matching learned beaconing patterns, enabling real-time detection of threats while significantly reducing overall computational overhead compared to comprehensive deep inspection of all traffic.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12621313B2Detection of malicious beaconing in virtual private networks

Publication Date: 2026.05.05 SNOWFLAKE INC

AI summary

A computer-implemented method includes accessing virtual private cloud flow logs of network traffic data originating from a virtual private cloud, generating filtered flow logs by filtering the virtual private cloud flow logs, extracting features based on a plurality of attributes from the filtered flow logs, training one or more machine learning models based on the features, applying the one or more machine learning models to the network traffic data to identify potential beacons, generating an alert notification that identifies the potential beacons, and communicating the alert notification to an alerting system.