Checksum Comparison for Multi-AET Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IDS/IPS solutions are ineffective in detecting and preventing attacks that employ multiple concurrent Advanced Evasion Techniques (AETs), which bypass network-based security systems and firewalls.
Innovation Solution
A method and system that utilize a Host Intrusion Protection System (HIPS) and an Intrusion Detection and Prevention System (IDS/IPS) to perform data-checks on payload data, comparing checksums calculated by both systems to identify potential attacks, including those using multiple AETs, and take appropriate actions such as terminating connections or notifying users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IDS/IPS solutions are used to monitor network traffic, then basic attack detection is possible, but attacks employing multiple concurrent Advanced Evasion Techniques (AETs) cannot be detected or prevented
Solution Approach 1:
The patent introduces a checksum comparison mechanism as an intermediary verification layer between the IDS/IPS and the target host. The HIPS on the target host calculates checksums of received payload data and compares them with checksums calculated by the IDS/IPS from the same traffic. This intermediary comparison mechanism enables detection of attacks that would otherwise evade traditional IDS/IPS analysis, as any modification to bypass AETs will cause checksum mismatches.
2Measurement precision
If the IDS/IPS performs comprehensive analysis of application-level payload data, then detection accuracy improves, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts the complex task of comprehensive payload analysis from the IDS/IPS and delegates it to the HIPS on the target host. The IDS/IPS only needs to calculate checksums and compare them with the HIPS, while the HIPS performs the actual payload data verification. This extraction of analytical functions reduces the complexity burden on the network-based IDS/IPS while maintaining high detection accuracy through the collaborative checksum verification mechanism.
Data Source
AI summary
A method of identifying a potential attack in network traffic includes payload data transmitted to a host entity in the network. The method includes: performing a first data-check on one or more data bytes of the payload data at the host entity; performing a second data-check, equivalent to the first data-check, on data of the network equivalent to the one or more bytes of payload data; and comparing the results of the first and second data-checks to determine if there is a mismatch, the mismatch being an indication of a potential attack.