Web Traffic Detection Baseline Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection methods for malicious communications in enterprise networks rely heavily on signatures and require manual effort, making it difficult to detect unknown or stealthy malware and command-and-control communications, and are overwhelmed by the volume and noise in outbound web traffic data.
Innovation Solution
A method that generates a database of external connections over time, applies filtering operations using a whitelist and domain folding to reduce noise, and analyzes filtered connections to identify suspicious activity, including new or obscure destinations and dynamically generated domains, to detect potentially malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malicious communications, then known malware and attacks can be detected, but unknown or stealthy malware and command-and-control communications cannot be detected and considerable manual work is required
Solution Approach 1:
The system automatically builds and updates the baseline database of external destinations by monitoring enterprise network traffic over time, and automatically compares new connections against this baseline to identify suspicious activity. This self-updating mechanism eliminates the need for manual signature updates and reverse engineering, while maintaining high detection accuracy for both known and unknown threats.
Solution Approach 2:
The system performs preliminary monitoring and baseline establishment during a learning period before full detection begins. This preliminary action creates a reference database of normal enterprise traffic patterns, enabling automatic detection of deviations without requiring pre-configured signatures for each potential threat.
2Reliability
If all outbound web traffic is monitored and analyzed, then suspicious communications can be identified, but the system is overwhelmed by the volume and noise in the traffic data
Solution Approach 1:
The system extracts only the essential feature needed for detection - the external destination (domain name or IP address) - from the complex web traffic data. By focusing solely on destination identification and comparison against the baseline database, the system eliminates overwhelming volumes of irrelevant traffic details while maintaining reliable detection of suspicious communications.
Solution Approach 2:
The system applies different processing quality to different parts of the traffic data: full monitoring and baseline building for all traffic during the learning period, then selective comparison against the baseline for new traffic. This local quality approach reduces overall processing load while maintaining detection reliability for suspicious activity.
Data Source
AI summary
Methods, apparatus and articles of manufacture for detecting suspicious web traffic are provided herein. A method includes generating a database comprising information corresponding to each of multiple connections between one or more destinations external to an enterprise network and one or more hosts within the enterprise network, wherein said multiple connections occur over a given period of time; processing multiple additional connections between one or more destinations external to the enterprise network and one or more hosts within the enterprise network with one or more filtering operations to produce one or more filtered connections, wherein said multiple additional connections occur subsequent to said given period of time; and analyzing said filtered connections against the database to identify a connection to a destination external to the enterprise network that is not included in the information in the database.