Dynamic Security Filtering via Certainty Value Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security measures, such as firewalls and intrusion detection systems, fail to provide comprehensive protection against computer system attacks, as they either block legitimate traffic or require frequent updates and generate false positives, leading to inadequate safeguards against vulnerabilities and intrusions.
Innovation Solution
A system that determines an initial system certainty value, compares incoming data with a database of signatures each with a certainty value, and filters data based on matching and non-matching results, adjusting the certainty value to differentiate between legitimate and suspicious traffic, thereby enhancing the likelihood of blocking attacks while minimizing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls are used to block unauthorized access, then security protection is improved, but legitimate traffic may be blocked and comprehensive protection is not achieved
Solution Approach 1:
The system continuously monitors network traffic patterns and dynamically adjusts filtering rules based on observed behavior. Legitimate traffic patterns are learned and automatically permitted, while deviations from normal patterns trigger blocking actions, resolving the contradiction between security and legitimate traffic flow
Solution Approach 2:
The firewall transitions from static rule-based filtering to dynamic adaptive filtering that changes behavior based on real-time traffic analysis. The system adapts its security posture dynamically, allowing legitimate traffic to flow freely while automatically blocking suspicious patterns, thus maintaining both security and operational ease
2Reliability
If intrusion detection systems are used to detect attacks, then security monitoring is improved, but false positives increase and monitoring burden increases
Solution Approach 1:
The system automatically learns normal traffic patterns and makes autonomous decisions about what to block without requiring continuous human intervention. The automated learning and decision-making processes reduce false positives and eliminate the need for manual monitoring, resolving the contradiction between detection accuracy and monitoring burden
Solution Approach 2:
Manual monitoring and analysis tasks are replaced with automated machine learning algorithms that continuously analyze traffic patterns. This substitution eliminates human monitoring burden while maintaining high detection accuracy through automated pattern recognition and anomaly detection
3Reliability
If pattern matching systems are used to inspect network packets, then attack detection capability is improved, but signature database updates are required frequently and many packets are blocked unnecessarily
Solution Approach 1:
Instead of maintaining a database of known attack signatures and matching traffic against them, the system inverts the approach by learning what normal traffic looks like and blocking anything that deviates from this baseline. This eliminates the need for frequent signature database updates and reduces unnecessary blocking of legitimate traffic
Solution Approach 2:
The system changes the fundamental parameter being monitored from 'known attack patterns' to 'normal traffic behavior'. By shifting the reference point from malicious to legitimate traffic characteristics, the system eliminates database maintenance complexity while improving detection accuracy
4Reliability
If anomaly based systems are used to create traffic profiles, then intrusion detection is improved, but profile creation becomes difficult as networks grow and hackers can distort profiles
Solution Approach 1:
The system automatically adapts to network growth and changing traffic patterns without requiring manual profile creation or adjustment. Machine learning algorithms continuously learn and update traffic baselines, making the system self-adjusting to network expansion and resistant to hacker attempts at profile distortion
Data Source
AI summary
Methods and systems for maintaining computer security are provided. The method for maintaining security of a computer system comprises determining an initial system certainty value for the computer system, providing access to a database of signatures, each signature including a signature certainty value, receiving data, comparing the received data with the database of signatures, increasing the system certainty value if the received data does not match a signature in the database, decreasing the system certainty value if the received data matches a signature in the database and filtering the data based on the system certainty value and the signature certainty value of a signature matching the received data.