Enhanced Intrusion Detection System for Encrypted Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems (IDS) are ineffective against encrypted network traffic, as they cannot decrypt SSL traffic, allowing attackers to conceal their probes and attacks within encrypted packets, rendering them blind to potential threats.
Innovation Solution
An enhanced intrusion detection system (EIDS) is developed that includes a security software module capable of decrypting SSL encrypted traffic, allowing the sensor module to analyze and detect attacks without terminating or interfering with the SSL session, by using a decryption module and an adaptor module that interfaces with the IDS to route and preprocess the encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used to protect network traffic, then network security is improved, but intrusion detection capability deteriorates because IDS sensors cannot decrypt the traffic
Solution Approach 1:
The patent introduces an intermediary decryption module that acts as a mediator between the encrypted traffic and the IDS sensor. This module decrypts SSL traffic using stored session keys and certificates, converting encrypted packets into readable format that the IDS can analyze, thereby resolving the contradiction between maintaining encryption security and enabling intrusion detection
Solution Approach 2:
The system segments the intrusion detection function into two parts: the decryption module that handles encryption/decryption operations and the IDS sensor that performs attack detection. This segmentation allows each component to specialize in its function, with the decryption module preserving security through encryption while the IDS module gains the ability to detect attacks in decrypted traffic
2Difficulty of detecting and measuring
If IDS sensors monitor all network traffic, then attack detection is improved, but system complexity increases due to the need to decrypt encrypted traffic
Solution Approach 1:
The system performs preliminary decryption of SSL traffic before it reaches the IDS sensor. By pre-decrypting the traffic using the decryption module that stores session keys and certificates, the IDS sensor receives already-decrypted traffic, eliminating the need for the sensor itself to have complex decryption capabilities and thus reducing overall system complexity
3Difficulty of detecting and measuring
If SSL traffic is decrypted for analysis, then intrusion detection is improved, but SSL session integrity may be compromised
Solution Approach 1:
The decryption module creates a copy of the SSL traffic for analysis while leaving the original encrypted traffic flow intact. By decrypting copies of the packets rather than modifying the actual SSL session, the system enables intrusion detection on the copied traffic while preserving the integrity and confidentiality of the original SSL communication between client and server
Data Source
AI summary
A system and method for detecting network attacks within encrypted network traffic received by a protected network includes a decryption module and an adaptor module. This system and method can be inserted and used with multiple types of operating systems.