Cloud Attack Prevention Server with Multi-Stage Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based environments face challenges in effectively preventing or detecting computer attacks, which can damage computer assets and compromise personal data, leading to financial and reputational losses.
Innovation Solution
A method and apparatus that utilize a two-phase filtering system within an attack prevention/detection server to examine IP packets for service requests, employing white-list, black-list, and base-rule patterns to identify and prevent attacks, while masking the IP addresses of protected computer assets from public access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a cloud-based environment is used to provide accessible computer services, then service availability and ease of operation are improved, but vulnerability to computer attacks and harmful factors increases
Solution Approach 1:
The patent introduces an attack prevention/detection server as an intermediary component between client systems and protected computer assets in the cloud environment. This server acts as a mediator that intercepts service requests, analyzes them for malicious content using multiple filtering mechanisms (white-list, black-list, base-rule patterns), and determines whether to allow or block requests. This intermediary structure enables cloud services to remain accessible while providing a protective layer that filters out attacks before they reach protected assets.
2Reliability
If comprehensive attack detection methods are implemented, then security reliability is improved, but system complexity and processing time increase
Solution Approach 1:
The patent segments the attack detection system into three distinct filtering mechanisms: white-list filtering (allowing only known good patterns), black-list filtering (blocking known bad patterns), and base-rule pattern filtering (applying general security rules). Each filter operates independently with its own rule set and decision logic. This segmentation allows the system to achieve comprehensive detection capability while maintaining manageable complexity by dividing the detection task into separate, specialized components.
Solution Approach 2:
The patent applies different filtering strategies to different types of service requests based on their characteristics. The white-list filter is applied when exact pattern matches are found, the black-list filter when malicious patterns are detected, and base-rule patterns for general security validation. Each filtering mechanism has its own local quality and rule set optimized for specific detection scenarios, allowing the system to handle diverse attack types effectively without requiring a single monolithic complex system.
3Measurement precision
If multiple filtering patterns are used to detect attacks, then detection precision is improved, but processing time and productivity are reduced
Solution Approach 1:
The patent implements preliminary action by applying the white-list filter first, which checks service requests against a pre-established list of known good patterns. This preliminary filtering quickly identifies and allows legitimate requests without requiring more complex analysis. The black-list filter is then applied as a second preliminary check to quickly block obviously malicious requests. Only requests that pass or fail these preliminary filters proceed to the base-rule pattern analysis, which is more computationally intensive. This staged approach ensures high detection precision while maintaining processing efficiency by handling most requests with faster filters.
Data Source
AI summary
The invention introduces a method for preventing or detecting computer attacks in a cloud-based environment, performed by a processing unit of an apparatus, which contains at least the following steps. A first IP (Internet Protocol) packet is received from a client system through the Internet. A service request is acquired from the first IP packet, which requests service to a protected computer asset. It is determined whether the service request contains a computer attack. An attack prevention/detection operation is performed to prevent an attack from damaging the protected computer asset when the service request contains a computer attack.