Edge NIDPS Mode Switching for Resource-Limited Threat Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Edge computing environments face resource constraints that make it impractical to run Network Intrusion Detection and Prevention Systems (NIDPS) continuously, as deep packet inspection is resource-intensive and not all edge devices need the same set of rules and signatures.
Innovation Solution
NIDPS agents operate in a 'lazy' mode to minimize pre-processing and compress packets, transmitting them to the cloud for analysis, switching to a 'preventative' mode upon threat detection, enforcing received rules and signatures, and reverting to 'lazy' mode when threats subside, with shared agents across gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If NIDPS performs deep packet inspection continuously in preventative mode, then security threat detection capability is improved, but resource consumption (computation and storage) increases excessively for edge devices with limited capabilities
Solution Approach 1:
The NIDPS agent dynamically switches between two operational modes: lazy mode for normal operation with minimal processing, and preventative mode when threats are detected. This dynamic adaptation allows the system to optimize resource usage while maintaining security effectiveness, resolving the contradiction between continuous inspection and resource conservation
Solution Approach 2:
Instead of continuous deep packet inspection, the system employs periodic action by triggering preventative mode only when security threats are detected by the cloud IDS. This periodic activation of resource-intensive inspection significantly reduces overall resource consumption while maintaining security detection capability
2Reliability
If NIDPS pulls and stores all latest rules and signatures from cloud at each edge computing system, then comprehensive threat detection coverage is improved, but storage and synchronization overhead increases unnecessarily
Solution Approach 1:
The system extracts only the specific rules and signatures relevant to detected threats from the cloud IDS, rather than pulling and storing all available rules and signatures. This selective extraction reduces storage overhead at edge devices while maintaining comprehensive detection coverage for actual threats
Solution Approach 2:
The cloud IDS automatically pushes relevant rules and signatures to edge NIDPS agents based on detected threats, eliminating the need for edge devices to continuously pull and synchronize all rules. This self-service mechanism reduces synchronization overhead and storage requirements
Data Source
AI summary
Computer-implemented methods, systems and program products extending traditional cloud-centric intrusion detection to edge networks. NIDPS is decentralized between the edge and cloud. Edge gateways equipped with NIDPS agents capture packets of network traffic and pre-process the data. Pre-processing output is compressed and sent to cloud intrusion detection services equipped with latest available rules and signatures. As cloud IDS detects security threats using rules and signatures, NIDPS agents are alerted and switched from “lazy mode” to “preventative mode.” While in preventative mode, NIDPS agents inspect packets of network traffic in accordance with the rules and signatures associated with the detected security threat, dropping packets that trigger the rules and signatures, while still compressing and transmitting other packets to cloud IDS for analysis. Once no active rules or signatures are enforced for pre-set or configured periods of time, NIDPS agents revert back to “lazy mode” to conserve network resources.