Attack-Path Detection Signatures Using Network Policy Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems fail to leverage network configuration and policy data to detect malicious network activity effectively, relying solely on traffic monitoring and pattern matching.
Innovation Solution
A method that generates detection signatures based on a software representation of network configuration and policy data, using fuzzers to explore possible attack paths and create detection signatures that account for network entities, transitions, and conditions, which are deployed at various locations within the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional traffic monitoring and pattern matching are used for detection, then the system operation is simple, but the detection precision is insufficient because network configuration and policy data are not leveraged
Solution Approach 1:
The system performs preliminary actions by generating a software representation of the network configuration and policy data before detection occurs. This pre-computed model enables detectors to query attack paths and generate signatures based on actual network permissions, significantly improving detection precision without requiring complex real-time analysis during traffic monitoring
Solution Approach 2:
The patent introduces a software representation as an intermediary between the network configuration data and the detection system. This intermediary model translates complex network policies into queryable attack path information, allowing detectors to efficiently determine whether observed traffic violates network permissions without directly parsing complex policy data
2Reliability
If network configuration and policy data are integrated into detection, then the detection precision improves, but the device complexity increases due to software representation generation and management
Solution Approach 1:
The system segments the security detection functionality into distinct components: a software representation generator that creates the network model, and detectors that query this model. This segmentation allows each component to be optimized independently - the generator handles complex policy processing once, while detectors perform simpler queries during runtime, improving reliability without proportionally increasing overall complexity
Solution Approach 2:
The patent creates a software copy or representation of the network configuration and policy data. This copy enables detectors to query attack paths and generate signatures based on the replicated model rather than directly accessing complex policy data, improving security reliability while managing complexity through abstraction
3Loss of information
If detection signatures are generated based on attack paths, then the loss of information is reduced by accounting for network context, but the productivity decreases due to additional analysis steps
Solution Approach 1:
The system performs preliminary analysis by generating the software representation and pre-computing attack paths before detection occurs. This allows detectors to quickly query pre-analyzed information during runtime, reducing information loss about network context while minimizing the impact on detection speed through efficient query mechanisms
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Disclosed is an approach for generating detection signatures based on analysis of a software representation of what is possible in a computer network based on network configuration data and network policy data. In some embodiments, the process includes maintaining a plurality of detection signature templates, generation of detection signatures (detection signature instances) using respective detection signature templates that are selected based on the analysis of the software representation. In some embodiments, detection signatures templates are of different type and may be deployed at different locations based on their respective type(s), such as at source, destination.