Cloud Neural Network Intrusion Detection for Suspicious Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in network security, particularly in detecting and preventing network intrusions such as distributed denial-of-service (DDoS) attacks, due to issues with data protection and privacy during large-scale network traffic processing.
Innovation Solution
Implementing a network intrusion detection system (NIDS) using a neural network that intercepts requests, analyzes geolocation and request rates, and employs a neural network module to identify legitimate or malicious traffic, preventing malicious requests from reaching the service provider system and providing early notification to administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a cloud computing system processes large scale network traffic, then productivity and scalability are improved, but network security and data protection are worsened
Solution Approach 1:
The patent introduces a neural network-based intrusion detection system as an intermediary component between network traffic and the cloud computing system. This mediator analyzes traffic patterns, identifies malicious requests, and filters threats before they reach the core system, enabling secure processing of large-scale network traffic without compromising security
Solution Approach 2:
The system segments network traffic analysis into multiple components: geolocation analysis, request rate analysis, and neural network-based parameter analysis. This segmentation allows parallel processing of different traffic aspects, improving detection efficiency while maintaining comprehensive security coverage for large-scale traffic
2Measurement precision
If traditional intrusion detection methods are used, then device complexity is reduced, but measurement precision and detection accuracy are worsened
Solution Approach 1:
The patent replaces traditional rule-based and signature-based detection mechanisms with a neural network-based intelligent system. The neural network automatically learns patterns from training data and performs adaptive detection, achieving superior accuracy while the system manages complexity through modular architecture and distributed deployment
3Reliability
If centralized intrusion detection is implemented, then detection consistency is improved, but reliability and fault tolerance are worsened
Solution Approach 1:
The system divides the intrusion detection functionality into multiple distributed nodes, each running independent neural network instances. These nodes process traffic from different geographical regions autonomously, ensuring that failures in one node do not affect others, thereby improving fault tolerance while maintaining detection consistency through synchronized models
Solution Approach 2:
The system implements block list synchronization across distributed nodes, where detection results from one node are shared with others. This feedback mechanism ensures all nodes benefit from collective learning, maintaining detection consistency while the distributed architecture provides inherent fault tolerance
Data Source
AI summary
A method includes intercepting requests, which are analyzed to identify authenticated and suspicious requests. The suspicious requests are grouped into request groups based on respective geolocation information. A rate of requests is determined for a request group. In response to determining that the rate of requests is less than or equal to a request rate threshold, parameters of a suspicious request of the request group are analyzed to determining values of the parameters. In response to determining that the value of the parameters do not match with respective malicious parameter values stored in a block list, the suspicious request is analyzed using a neural network to identify if the suspicious request is legitimate or malicious. In response to identifying that the suspicious request is malicious, a notification indicating that the suspicious request is identified as malicious is sent, and the values of the parameters are added to the block list.