Distributed Firewall Using Statistical Traffic Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Web application firewalls require significant processing resources and memory to identify and prevent sophisticated cyber-attacks, as they rely on rule-based logic and signature-matching methods that become inefficient with varied and complex attack patterns.
Innovation Solution
A distributed firewall system that learns from traffic patterns by classifying URI parameters and values, using a pre-configured classifier to generate statistical rules that optimize traffic handling, allowing or blocking requests based on learned formats, thereby reducing the need for expensive signature checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based logic and signature-matching methods are used to detect attacks, then attack detection capability is improved, but processing resources and memory consumption increase
Solution Approach 1:
The system performs preliminary learning during a training phase to establish baseline traffic patterns and statistical models before actual attack detection begins. This pre-computed knowledge is stored and reused during operation, avoiding the need to maintain extensive rule sets and signatures in memory during real-time processing.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a statistical learning-based system. Instead of comparing traffic against pre-defined signatures using exact matching algorithms, the system uses statistical models to identify anomalies based on learned traffic patterns, reducing memory requirements for storing attack signatures.
2Reliability
If rule-based logic and signature-matching methods are used to detect attacks, then attack detection capability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary learning during a training phase to establish baseline traffic patterns and statistical models before actual attack detection begins. This pre-computed knowledge is stored and reused during operation, avoiding the need to maintain extensive rule sets and signatures in memory during real-time processing.
Solution Approach 2:
The patent changes the detection parameters from exact signature matching to statistical probability thresholds. By learning normal traffic patterns and establishing statistical baselines, the system can quickly evaluate whether traffic deviates significantly from normal behavior using simple statistical tests rather than complex pattern matching.
3Adaptability or versatility
If extensive rules and signatures are stored in database, then comprehensive attack coverage is improved, but memory usage increases
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a statistical learning-based system. Instead of comparing traffic against pre-defined signatures using exact matching algorithms, the system uses statistical models to identify anomalies based on learned traffic patterns, reducing memory requirements for storing attack signatures.
Solution Approach 2:
The system automatically learns and adapts to new attack patterns by continuously monitoring traffic and updating its statistical models. This self-learning capability eliminates the need for manual rule updates and extensive pre-stored signatures, as the system generates its own detection rules based on observed traffic patterns.
Data Source
AI summary
In an embodiment, a distributed firewall that learns from traffic patterns to prevent attacks is configured to receive traffic comprising one or more uniform resource identifiers (URIs), where a URI of the one or more URIs includes one or more parameters and one or more corresponding values. The firewall is configured to classify the corresponding value(s) using a pre-configured classifier and obtain a statistical rule that specifies an allowable type and an allowable length for traffic containing the one or more parameters, where the statistical rule is generated based on the classification. The firewall is configured to apply the statistical rule to incoming traffic to allow or drop requests comprising the parameter(s).