Behavioral Classifiers for Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems (IDS) in communication networks face challenges in accurately and efficiently detecting a wide variety of attacks while minimizing false positives and requiring frequent updates, especially in virtualized computing environments, due to their reliance on static detection rules and limited ability to distinguish between unknown threats.
Innovation Solution
A method involving layered behavioral classifiers, including a generation classifier and a discrimination classifier, using supervised and unsupervised machine learning to predict packet behavior, reducing false positives and eliminating the need for static rule updates by automatically learning normal and malicious patterns from network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If IDS systems use static detection rules to specifically target known attacks, then detection precision for known attacks is improved, but the system cannot detect unknown attacks and requires frequent manual updates by experts
Solution Approach 1:
The patent transforms static detection rules into dynamic machine learning models that automatically adapt to new attack patterns. The system uses supervised learning to create behavioral classifiers that evolve with network traffic, enabling detection of both known and unknown attacks without manual rule updates.
Solution Approach 2:
The patent replaces the mechanical system of manual rule creation and updating with an automated machine learning system. Behavioral classifiers are trained on network traffic data to automatically learn attack patterns, eliminating the need for expert intervention in rule maintenance.
2Adaptability or versatility
If IDS systems use behavioral models with automatic learning algorithms to discover unknown attacks, then adaptability to new threats is improved, but the rate of false positives becomes particularly high
Solution Approach 1:
The patent segments the detection process into multiple specialized classifiers: supervised behavioral classifiers for known attack patterns and unsupervised behavioral classifiers for anomaly detection. This segmentation allows each classifier to focus on specific aspects, reducing false positives while maintaining high adaptability.
Solution Approach 2:
The patent introduces behavioral classifiers as intermediary components between raw network traffic and detection decisions. These classifiers learn normal behavioral patterns and use them as a reference frame, allowing the system to distinguish between legitimate deviations and actual attacks, thereby reducing false positives.
3Reliability
If security experts manually update detection rules on a recurring basis to maintain protection, then detection precision is maintained, but the cost and time requirements increase significantly
Solution Approach 1:
The patent implements a self-service system where machine learning models automatically train and update detection capabilities using network traffic data. The behavioral classifiers continuously learn from new patterns without requiring expert intervention, making the system self-maintaining and eliminating recurring expert time requirements.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and network traffic patterns are continuously fed back to the machine learning models. This feedback loop enables automatic refinement of detection rules based on actual network conditions, maintaining reliability without manual updates.
4Adaptability or versatility
If IDS systems monitor network traffic to signal abnormal activities, then adaptability to new threats is improved, but the inability to precisely identify the nature of detected activities increases false positives
Solution Approach 1:
The patent segments the classification task into multiple specialized behavioral classifiers, each trained to recognize specific attack patterns or behaviors. By dividing the detection task across multiple classifiers with specialized knowledge, the system can both detect novel threats and precisely identify their nature, reducing false positives.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The invention relates to a method for determining network packet classifiers, a classifier being capable of predicting a packet's behavior among at least one normal behavior and one malicious behavior, and being called a "behavioral classifier".The said process includes the following steps: - classification (E70) of packets from a first set by a plurality of behavioral classifiers, so as to obtain a set of behaviors respectively predicted for the packets of said first set, - supervised learning (E80) of a behavioral classifier called "generation classifier" from said set of predicted behaviors as well as classification parameters respectively associated with the classifiers of said plurality of behavioral classifiers and determined for said first set, - unsupervised learning (E90) of a behavioral classifier called "discrimination classifier" from at least one unlabeled packet as well as a behavior predicted by the generation classifier for said at least one unlabeled packet.