Communication Blocker Resurrects Blocked Data via Error Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in balancing the detection of malicious communications with the prevention of false positives, often blocking valid data communications, which can lead to operational issues in devices and networks.
Innovation Solution
A method and system that selectively block data communications based on content, store blocked communications, and retrieve them upon error notifications to ensure accurate delivery, using a communication blocker, database, and resurrection server to manage and adapt communication blocking rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If intrusion detection rules have high detection sensitivity, then intrusion detection capability is improved, but false positive rate increases causing valid communications to be blocked
Solution Approach 1:
The system performs preliminary blocking of suspicious communications based on intrusion detection rules, storing them temporarily before final disposition. This allows the system to act quickly on potential threats while maintaining the option to reverse the blocking decision if the communication is later determined to be valid, thus resolving the contradiction between immediate security response and accurate communication delivery.
Solution Approach 2:
The system implements feedback mechanisms where blocked communications can be reviewed and unblocked if they are determined to be false positives. Error notifications from destination devices trigger re-evaluation of blocked communications, allowing the system to correct incorrect blocking decisions while maintaining high detection sensitivity, thereby balancing security with communication reliability.
2Object-affected harmful factors
If data communications are blocked to prevent intrusions, then network security is improved, but operational stability of devices deteriorates
Solution Approach 1:
The system prepares compensation mechanisms in advance by storing blocked communications and establishing error notification pathways. When device operational issues arise due to blocking, the system can retrieve and resend the blocked communications to cushion the impact on device stability, thus maintaining both security and operational reliability.
Solution Approach 2:
The system temporarily discards blocked communications in a holding state rather than permanently blocking them. When error notifications indicate that blocking may have caused operational issues, the system recovers the discarded communications by retrieving them from storage and resending them, thereby maintaining device stability while preserving security filtering capabilities.
3Reliability
If communication blocking rules are made adaptive, then false positive reduction is improved, but system complexity increases
Solution Approach 1:
The system implements self-service adaptive rule adjustment where the blocking system automatically modifies its own rules based on error notifications and communication patterns without requiring external intervention. This automation reduces the manual complexity of managing adaptive rules while improving communication delivery accuracy through continuous learning from system feedback.
Data Source
AI summary
Data communications between devices are selectively blocked and resurrected based on error notifications. Data communications from one or more source devices to one or more intended destination devices are selectively blocked based on content of the data communications. The blocked data communications are stored in a database. A blocked data communication is retrieved from the database in response to an error notification from one of the source devices and/or from one of the destination devices. The retrieved data communication is then sent to the intended destination device.