Adaptive Service Port Blocking for Low-Overhead Network Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network apparatuses face inefficiencies in defending against network attacks due to the need for additional processing and resource consumption when using honeypots and connection tracking, which allows attackers to focus on limited attack surfaces and occupy computing resources.
Innovation Solution
A network apparatus that selectively designates communication ports as service ports based on network environment, identifies illegal destination ports, and uses a block list to record and block unauthorized connections, reducing the need for extensive resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If honeypots are opened to lure attackers, then attack blocking capability is improved, but computing resources and memory are occupied
Solution Approach 1:
The patent extracts the attack detection function from the main network apparatus by using a separate honeypot system. The honeypot isolates attacker interactions away from the production network, allowing full resource allocation to attack blocking without impacting normal network operations. This separation enables the main system to focus on blocking while the honeypot handles attacker engagement.
Solution Approach 2:
The patent introduces a mediator component that analyzes traffic between the honeypot and attackers, and between the main network and external devices. This mediator filters and evaluates packets, determining whether to allow or block connections based on learned attacker behavior patterns, thereby reducing the computational burden on the main network apparatus.
2Reliability
If connection tracking and DOS attack defence are performed, then network security is improved, but processing time and resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-configuring service ports and pre-establishing blocking rules based on honeypot observations. Before actual attacks occur, the system learns attacker patterns and prepares blocking mechanisms in advance, reducing the need for real-time analysis during attack events and minimizing processing time.
Solution Approach 2:
The patent implements a fast-path mechanism that allows legitimate traffic to skip detailed inspection and flow through the system rapidly. Only suspicious traffic requiring security analysis undergoes full connection tracking and inspection, enabling most packets to be processed quickly while maintaining security for potentially malicious flows.
3Adaptability or versatility
If service ports are opened for external connections, then network functionality is improved, but attack surface is increased
Solution Approach 1:
The patent applies local quality by differentiating between service ports and non-service ports with distinct access policies. Service ports have controlled access based on learned patterns and verification, while non-service ports are strictly blocked. This localized security approach allows necessary functionality while minimizing the attack surface to only essential ports.
Solution Approach 2:
The patent dynamically changes the state of port accessibility based on observed traffic patterns and verification results. Ports transition between open, restricted, and blocked states depending on the legitimacy of connection attempts, allowing the system to adapt the attack surface in real-time based on actual threats and functional requirements.
Data Source
AI summary
A network apparatus and a network attack blocking method thereof are disclosed. The network apparatus includes a network interface device, a storage device, and a processor. The network interface device connects a network. The storage device stores a block list. The processor is coupled to the network interface device and the storage device, and selectively allows at least one communication port to serve as a service port for connecting with an external device according to environment information of the network, receives a network packet sent by the external device through the network by using the network interface device, and determines whether a destination port of the network packet is one of the service ports. If the destination port is one of the service ports, the processor establishes a connection with the external device and provides services. If the destination port is not one of the service ports, the processor blocks the connection of the external device and adds identification information of the external device to the block list.