Abnormal Traffic Analysis Using Header Extraction and Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) face performance limitations in high network traffic environments, struggle with updating detection rules for new intrusion modes, and are ineffective in detecting encrypted data packets, particularly in IPV6 networks.
Innovation Solution
An abnormal traffic analysis method and apparatus that calculates index values from IP network data headers, performs primary and secondary detections using a vector-based approach, and employs a Bloom filter algorithm and neural networks to identify abnormal traffic without packet inspection, enabling efficient detection in large networks and encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional IDS/IPS performs packet inside detection to analyze data streams, then detection accuracy is improved, but system performance is limited and cannot handle large network traffic
Solution Approach 1:
The patent extracts only the necessary header information from IP packets for analysis, completely avoiding the packet inside detection process. By taking out only the header fields (source IP, destination IP, port numbers, protocol types) and discarding the payload inspection step, the system achieves both high performance and adequate detection capability for abnormal traffic patterns.
Solution Approach 2:
The patent creates a simplified representation (copy) of packet information using header fields and statistical indices, rather than processing the actual packet data. This copying approach allows the system to analyze traffic patterns through derived features (connection frequency, data volume ratios) without the computational burden of deep packet inspection.
2Measurement precision
If traditional IDS/IPS uses predetermined rules for detection, then detection accuracy is improved, but the system cannot detect encrypted data packets in IPV6 networks
Solution Approach 1:
Instead of trying to penetrate encrypted packets to find attack signatures (the traditional approach), the patent inverts the approach by analyzing traffic from the outside through statistical patterns of packet headers. This inversion makes the detection method compatible with encrypted traffic, as it doesn't require decrypting or inspecting packet contents.
Solution Approach 2:
The patent changes the detection parameters from content-based analysis (payload inspection) to statistical parameter analysis (connection frequency, data volume ratios, temporal patterns). This parameter transformation enables detection of abnormal traffic behaviors even when packet contents are encrypted, as the statistical patterns remain visible in the headers.
3Measurement precision
If traditional IDS/IPS updates detection rules manually, then rule accuracy is improved, but update speed is slow and cannot keep pace with new intrusion modes
Solution Approach 1:
The patent implements self-service through automated anomaly detection and learning. The system automatically identifies abnormal traffic patterns, learns from historical data, and adapts detection criteria without manual intervention. This self-service capability allows the system to respond to new intrusion modes in real-time as they emerge from network traffic.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and traffic patterns are continuously fed back into the system for analysis. This feedback loop enables the system to learn from actual network behavior, refine its detection models, and automatically adapt to changing traffic patterns and emerging attack methods.
Data Source
AI summary
The present invention discloses a network abnormal traffic analysis method, which calculates a set of index values of a monitored server based on the acquired IP network data, performs a primary detection on the calculated set of index values to generate vector corresponding to the set of index values, and performs a secondary detection on the vector to determine whether abnormal traffic and abnormal types related to the monitored server exist. The present invention also relates to a network abnormal traffic analysis apparatus related therewith and a network traffic monitoring system and method adopting these network abnormal traffic analysis method and apparatus.