Web Tap HTTP Traffic Anomaly Detection for Covert Channel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures, such as firewalls and proxy servers, are ineffective in detecting covert communication methods like HTTP tunnels and spyware, which exploit outbound HTTP connections to transmit data, as they often rely on signature analysis that fails to detect new attacks and are difficult to distinguish from legitimate traffic.
Innovation Solution
The system, called Web Tap, monitors outbound application-layer messages for anomalies using filters such as header format, inter-request delay time, request size, bandwidth usage, request regularity, and time of day to detect security threats, focusing on differentiating between legitimate and malicious HTTP traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature analysis is used to detect security threats, then known malware can be identified, but new attacks and covert communication methods cannot be detected
Solution Approach 1:
The patent changes the detection parameters from static signature matching to dynamic behavioral analysis. Instead of checking if traffic matches known malware signatures, the system monitors temporal patterns, request intervals, data volume, and communication behavior to detect anomalies that indicate covert channels or new attacks, thereby improving adaptability while maintaining reliability through multi-parameter validation
2Reliability
If firewall and proxy server rules are made more restrictive to block potential threats, then security is improved, but legitimate traffic may be blocked
Solution Approach 1:
The system implements feedback mechanisms where detected behavioral patterns are continuously learned and used to refine detection thresholds. Legitimate traffic patterns are established as baselines, and deviations from these baselines trigger alerts rather than immediate blocking. This allows the system to maintain high security while preserving legitimate traffic flow through adaptive, learning-based decision making
3Measurement precision
If monitoring of outbound HTTP traffic is increased to detect covert channels, then detection capability is improved, but false positives increase
Solution Approach 1:
The patent segments the detection process into multiple independent analysis dimensions including temporal patterns, spatial distribution, data volume characteristics, and protocol behavior. Each dimension generates independent scores that are combined to produce a final threat assessment. This multi-dimensional segmentation reduces false positives by requiring consistent anomalies across multiple dimensions rather than triggering alerts from single unusual parameters
Data Source
AI summary
A method, system and computer program product detect attempts to send significant amounts of information out via HTTP tunnels to rogue Web servers from within an otherwise firewalled network. A related goal is to help detect spyware programs. Filters, based on the analysis of HTTP traffic over a training period, help detect anomalies in outbound HTTP traffic using metrics such as request regularity, bandwidth usage, inter-request delay time, and transaction size.