Dynamic Intrusion Rule Segmentation for Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection and prevention systems consume excessive processing resources due to increasing network speeds and the growing number of attacks, potentially denying other processes access to computer resources as they prioritize detection and prevention.
Innovation Solution
An intrusion prevention system that filters network traffic based on active networked applications, using a subset of intrusion rules that change as applications initiate or terminate connections, focusing on specific active applications to reduce processing requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection or prevention systems examine all network traffic for all known attacks, then detection coverage is improved, but processing resource consumption increases excessively
Solution Approach 1:
The patent segments the full ruleset into multiple subsets, each corresponding to a specific active networked application. The intrusion detection system processes network traffic against only the relevant subset for currently active applications, rather than examining all rules for all applications. This segmentation reduces processing resource consumption while maintaining detection coverage for active applications.
Solution Approach 2:
The system performs partial action by examining only a portion of the full ruleset (the subset relevant to active applications) rather than the complete set of all possible attack signatures. This partial examination is sufficient to detect attacks against currently running applications while avoiding the excessive processing required to check all rules.
2Reliability
If intrusion detection systems check all network traffic against all known attacks, then security reliability is improved, but system productivity deteriorates due to resource consumption
Solution Approach 1:
The ruleset is segmented into application-specific subsets that are dynamically loaded based on which applications are currently active. This allows the system to maintain high security reliability for active applications while preserving system productivity by avoiding processing overhead for inactive applications.
Solution Approach 2:
The system dynamically adjusts the ruleset subset based on the runtime state of networked applications. As applications are started or stopped, the corresponding intrusion rules are activated or deactivated, allowing the system to optimize its processing load dynamically while maintaining appropriate security coverage.
3Reliability
If the number of attacks to detect increases, then detection capability is improved, but processing complexity increases
Solution Approach 1:
The growing number of attack signatures is organized into segmented subsets associated with specific applications. This segmentation manages processing complexity by ensuring that only the relevant subset of rules (those applicable to active applications) is processed, rather than managing complexity through reducing the total number of rules.
Data Source
AI summary
Intrusion prevention for a computer is based on intrusion rules corresponding to active networked applications executing on the computer. The intrusion rules are a subset of a full ruleset that may include signatures of known attacks or heuristic rules. The subset changes as network connections for active applications are initiated and terminated, or as the active applications terminate.