Compact Rule Set Generation for Network Protocol Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing protocol content detection methods in Intrusion Prevention Systems (IPS) require extensive configuration and consume unnecessary resources by enabling all detection rules, leading to inefficiency and performance issues due to the vast number of protocol types and categories.
Innovation Solution
A method and device that learn network traffic to identify protocol-related information, generate a compact rule set, and perform detection only for potential threats, reducing unnecessary resource consumption and improving efficiency by integrating vulnerability rules from a vulnerability rule base.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all protocol detection rules are enabled, then detection coverage is improved, but resource consumption increases and detection efficiency decreases
Solution Approach 1:
The patent segments the complete protocol detection rules into multiple rule sets, each corresponding to a specific protocol type. Instead of enabling all rules simultaneously, the system selectively enables only the rule sets corresponding to protocols actually present in the network, thereby maintaining detection coverage for relevant threats while reducing resource consumption.
Solution Approach 2:
The patent performs preliminary identification of protocol types in the network before enabling detection rules. By analyzing network traffic to determine which protocols are actually used, the system prepares and enables only the necessary detection rule sets in advance, avoiding the overhead of processing all possible protocol rules.
2Reliability
If all protocol detection rules are enabled, then detection coverage is improved, but performance consumption increases
Solution Approach 1:
The patent extracts and removes unnecessary detection rules from the active rule set. By identifying protocols that are not present in the network, the system takes out the corresponding detection rules from execution, thereby reducing performance consumption while maintaining coverage for actually used protocols.
Solution Approach 2:
The system performs preliminary protocol type identification to determine which detection rules are necessary before enabling them. This preliminary action prevents the system from consuming performance resources on rules that would not detect any actual threats in the network environment.
3Measurement precision
If manual configuration of detection rules is performed, then detection accuracy is improved, but configuration time increases
Solution Approach 1:
The patent implements self-service by automatically identifying protocol types in the network and selecting appropriate detection rule sets without requiring manual user configuration. The system autonomously performs protocol analysis and rule selection, thereby achieving accurate detection configuration while eliminating the time loss associated with manual setup.
Solution Approach 2:
The system uses feedback from network traffic analysis to automatically adjust and configure detection rules. By continuously monitoring protocol types in the network and using this feedback to select appropriate rule sets, the system achieves accurate detection configuration automatically, eliminating the need for time-consuming manual configuration while maintaining high detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention discloses a method and a device for optimizing and configuring a detection rule, where the method includes: receiving network traffic; extracting a packet from the network traffic, and identifying, according to a feature of the packet, protocol related information used in the network; saving correspondence between the protocol related information and the protocol related information to a first learning association table; and matching a corresponding rule item from a vulnerability rule base according to the protocol related information, so as to generate a first compact rule set. Through the generated compact rule set in the present invention, subsequent protocol detection is performed only for a protocol threat that may occur in a live network; therefore, content that needs to be detected subsequently is reduced, the detection efficiency is improved, and unnecessary performance consumption is avoided at the same time.