5-tuple Classifier for Intrusion Detection False Positives

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current intrusion detection systems in network switches using a single DFA for all signatures generate numerous false positives due to not accounting for flow-type or protocol differences, overwhelming the post-processor and potentially missing real security threats.

Innovation Solution

Implement a pre-classification mechanism using a 5-tuple classifier to direct packets to specific DFAs based on IP and protocol information, reducing false positives by matching signatures to relevant flows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a single DFA is used for all signatures, then device complexity is reduced, but false positive detection increases

Engineering Contradiction:

ImproveDFA structureVSAvoidfalse positive rate

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the single DFA into multiple protocol-specific DFAs (TCP DFA, UDP DFA, ICMP DFA, etc.), each handling only its corresponding protocol type. This segmentation eliminates false positives by ensuring that signatures are only matched against packets of the appropriate protocol type, while the overall system complexity remains manageable through modular organization.

Inventive Principle:

Principle #1Segmentation

2Reliability

If protocol-specific DFAs are implemented, then false positive rate is reduced, but device complexity increases

Engineering Contradiction:

Improvefalse positive rateVSAvoidDFA structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements a protocol classification stage that occurs before packet signature matching. This preliminary action identifies the protocol type of incoming packets and directs them to the appropriate DFA, preventing false positives upfront and reducing the processing burden on subsequent stages without requiring complex DFA structures.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a protocol classification mechanism as an intermediary between packet reception and signature matching. This intermediary component analyzes packet headers to determine protocol type and routes packets to the appropriate DFA, thereby reducing false positives while keeping the DFAs themselves relatively simple and manageable.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If protocol classification is performed, then false positives are reduced, but processing overhead increases

Engineering Contradiction:

Improvefalse positive rateVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The protocol classification is performed as a preliminary action using simple header field comparisons (protocol type bits) that can be executed extremely quickly. This preliminary classification occurs before the more time-consuming signature matching process, thereby reducing false positives without significantly increasing overall processing time.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS7802094B2Reduction of false positive detection of signature matches in intrusion detection systems

Publication Date: 2010.09.21 VALTRUS INNOVATIONS LTD

AI summary

Detection of a signature in a data packet comprises performing a pre-classification of the packet, using header information and particularly a 5-tuple access control list, into one of a multiplicity of flows and directing the payload of the packet to a respective one of a multiplicity of deterministic finite state machines each of which stores a plurality of signatures as a sequence of states and acts only on the respective flow.