Connection Table for Network Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection systems face challenges in efficiently identifying and classifying security violations, such as denial of service attacks, worm propagation, and unauthorized access, due to high false positive rates and the need for manual threshold settings, which increase operational costs and complexity.
Innovation Solution
A data structure comprising a connection table that maps each network node to a record object, tracking traffic information with indexed source and destination addresses and time, allowing for the aggregation of traffic statistics and anomaly detection through a clustering process that groups hosts based on connection patterns, reducing false positives and automating anomaly classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual threshold settings are used for anomaly detection, then detection accuracy can be adjusted, but operational complexity and costs increase
Solution Approach 1:
The system performs self-classification by automatically assigning hosts to roles (server, client, peer-to-peer) and detecting anomalies based on role violations without requiring manual threshold settings. The anomaly detector classifies itself by determining whether observed traffic patterns deviate from expected role-based behavior, eliminating the need for external manual configuration while maintaining detection accuracy.
Solution Approach 2:
The system changes the detection parameters from manual threshold settings to role-based classification parameters. Instead of requiring administrators to set numeric thresholds for anomaly detection, the system uses categorical role assignments (server, client, peer-to-peer) and their associated communication patterns as the detection parameters, simplifying operation while maintaining precision.
2Reliability
If detailed traffic tracking is implemented, then anomaly detection capability improves, but data processing complexity increases
Solution Approach 1:
The system extracts only the necessary traffic information needed for role classification and anomaly detection, rather than processing all detailed traffic data. By focusing on connection patterns, communication directions, and role assignments, the system reduces data processing complexity while maintaining reliable anomaly detection capability.
Solution Approach 2:
The system segments traffic analysis into distinct role-based categories (server traffic, client traffic, peer-to-peer traffic) with specific detection rules for each role. This segmentation allows complex traffic to be processed in manageable chunks according to role expectations, reducing overall processing complexity while improving detection reliability.
3Measurement precision
If high false positive rates occur, then detection sensitivity increases, but operational efficiency decreases
Solution Approach 1:
The system uses feedback from observed traffic patterns to continuously refine role classifications and anomaly detection. By monitoring actual communication behavior and comparing it against role-based expectations, the system adjusts its detection criteria to reduce false positives while maintaining sensitivity, thereby improving operational efficiency.
Solution Approach 2:
The system changes from using fixed sensitivity thresholds to dynamic role-based detection parameters. Instead of relying on static thresholds that generate false positives, the system uses contextual parameters derived from host roles and their expected communication patterns, achieving both high sensitivity and operational efficiency.
Data Source
AI summary
A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.