Dynamic Protocol Decoding for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewall and intrusion detection systems are inadequate in detecting malicious network traffic that uses compression or encoding schemes, leading to false positives and inability to detect certain classes of attacks, as they rely on predefined data pattern searches which can be evaded by intruders.
Innovation Solution
A method and system for dynamic protocol decoding and analysis that involves obtaining a protocol decoding program with rules and instructions, analyzing data packets, triggering rules based on decoding results, and executing instructions to terminate connections, log messages, or change packets, while handling exceptions and decoding encoded data streams to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If predefined data pattern search is used for intrusion detection, then simple implementation and fast processing are achieved, but detection capability against encoded/compressed attacks is lost and false positives increase
Solution Approach 1:
The system performs preliminary decoding of network traffic data before inspection. By decoding compressed or encoded data streams in advance, the system transforms obfuscated malicious traffic into its original form, enabling subsequent pattern matching to detect attacks that would otherwise be hidden. This preliminary action ensures reliable detection without requiring complex real-time analysis of encoded patterns.
Solution Approach 2:
The patent introduces an intermediary decoding layer between the network traffic and the intrusion detection engine. This intermediary component translates encoded/compressed data into a readable format, serving as a mediator that bridges the gap between obfuscated attack traffic and traditional pattern-based detection methods, thereby improving detection capability without directly modifying the core detection logic.
2Measurement precision
If deep packet inspection is performed to detect encoded attacks, then detection accuracy improves, but processing time and system resource consumption increase
Solution Approach 1:
The inspection process is segmented into distinct phases: decoding phase and inspection phase. The system first decodes the data stream, then performs pattern matching on the decoded content. This segmentation allows the system to optimize each phase independently, performing computationally intensive decoding only when necessary, and using fast pattern matching on the resulting decoded data, thereby reducing overall processing time while maintaining high detection accuracy.
Solution Approach 2:
The system applies decoding and inspection selectively rather than to all traffic. By identifying indicators of encoded/compressed traffic and applying deep inspection only to suspicious packets, the system achieves high detection accuracy for targeted attack types while minimizing processing overhead for legitimate traffic, thus reducing average processing time.
Data Source
AI summary
A method for dynamically decoding protocol data on a computer system is provided using a protocol decoder, which inspects and analyzes protocol data received by the computer system. A protocol decoding program controls the decoding and analysis process. The method may be used by an intrusion prevention system to identify anomalous protocol data that may cause harm to applications receiving the data.