Dynamic Intrusion Detection System for Slow-Moving Network Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems face difficulties in detecting long-term, slow-moving attacks that involve low-level dynamic activity, as they often rely on anomaly-detection, signature-based-queries, or machine-learning techniques which are inadequate for identifying complex attacks spanning several months.
Innovation Solution
An intrusion detection system that monitors network traffic using an audit policy to generate and analyze audit data, allowing administrators to define symptoms indicative of malicious activity, score them, and automatically focus data collection based on findings to detect complex attacks over extended periods while reducing processing load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If audit data is collected at a high auditing level to detect complex long-term attacks, then detection capability is improved, but processing load increases
Solution Approach 1:
The audit policy is made dynamic by automatically adjusting the auditing level based on detected symptoms and case scores. When suspicious activity is detected, the system increases the auditing level for specific components to gather more detailed data, and reduces it for normal components to lower processing load. This dynamic adjustment allows the system to maintain high detection capability for complex attacks while optimizing processing resources.
Solution Approach 2:
The system applies different auditing levels to different components based on their suspiciousness. Instead of uniformly high auditing across all components, the system focuses intensive auditing only on components exhibiting symptoms of malicious activity, while maintaining lower auditing levels for normal components. This local differentiation reduces overall processing load while maintaining detection effectiveness.
2Measurement precision
If comprehensive audit data is collected to identify complex attacks spanning months, then detection accuracy is improved, but data storage requirements increase
Solution Approach 1:
The system extracts and stores only the most relevant audit data based on detected symptoms and case scores. When suspicious activity is identified, the system selectively collects and retains detailed audit data for those specific components and time periods, rather than storing all audit data uniformly. This extraction approach maintains detection accuracy for complex long-term attacks while reducing overall storage requirements.
3Reliability
If the auditing level is increased to capture low-level dynamic activity, then detection of slow-moving attacks is improved, but system performance degradation increases
Solution Approach 1:
The system dynamically adjusts the auditing level based on the detected threat level and case scores. For components showing signs of slow-moving attacks, the auditing level is increased to capture low-level dynamic activity. For normal components, the auditing level is reduced to minimize performance impact. This dynamic approach enables detection of slow-moving attacks while maintaining overall system performance.
Data Source
AI summary
Techniques for detecting network intrusions are disclosed. An example intrusion detection system includes a storage device to store audit data generated by a network traffic analyzer in accordance with an audit policy that determines an auditing level. The system also includes a processor to receive a case defined by a case definition, wherein the case definition comprises a plurality of symptoms and each symptom is defined by a separate symptom definition. The processor performs queries of the audit data in accordance with each of the symptoms to generate captured symptom data. The symptoms are scored based on the captured symptom data to generate symptom scores, and the symptom scores are summed to generate a case score. If the case score exceeds an alert threshold specified by the case definition, the processor issues an alert.