Method and apparatus for remote malware monitoring
AssigneeThe Johns Hopkins University
InventorLanier A. Watkins
Life of this patent
Estimating the term…
Abstract
A method executable via operation of configured processing circuitry to identify applications by remote monitoring may include initiating remote communication with a target device through an access point, the access point providing network access to the target device, providing a series of ping messages to the target device via the access point to determine a delay signature of an application running on the target device, comparing the delay signature of the application to a plurality of malware traffic signatures stored in a malware traffic signature library, and determining a matching score between the delay signature of the application and at least some of the malware traffic signatures.
Claims14
An apparatus comprising processing circuitry configured to execute instructions for:
- initiating remote communication with a target device through an access point, the access point providing network access to the target device;
- providing a series of ping messages to the target device via the access point;
- determining inter-packet spacing for Internet Control Message Protocol (ICMP) replies to the series of ping messages from the target device;
- generating a delay signature of the target device based on the inter-packet spacing utilizing a Neural-Fuzzy Classifier;
- comparing the delay signature to a plurality of malware traffic signatures stored in a malware traffic signature library;
- and
- determining a matching score between the delay signature and one or more of the malware traffic signatures.
A method executable via operation of configured processing circuitry, the method comprising:
- initiating remote communication with a target device through an access point, the access point providing network access to the target device;
- providing a series of ping messages to the target device via the access point;
- determining inter-packet spacing for Internet Control Message Protocol (ICMP) replies to the series of ping messages from the target device;
- generating a delay signature of the target device based on the inter-packet spacing utilizing a Neural-Fuzzy Classifier;
- comparing the delay signature to a plurality of malware traffic signatures stored in a malware traffic signature library;
- and
- determining a matching score between the delay signature and one or more of the malware traffic signatures.
Dependencies are inferred from the claim text.