Executable Signature Logic for Intrusion Prevention Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion prevention systems face challenges in expressing vulnerability states through complex signature schemas and require frequent updates to detect new signatures, leading to heavyweight and complex engine maintenance.
Innovation Solution
Compiling signatures into executable logic that directs a network intrusion detection/intrusion prevention engine to evaluate traffic, using a safe compiler and interpreter framework to ensure safety and reduce engine complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature schemas with complex data structures are used to detect malicious content, then detection capability is improved, but engine complexity and maintenance burden increase
Solution Approach 1:
The patent uses regular expressions as a simplified copy or representation of the traditional complex signature data structures. Instead of using heavyweight schema-based signatures, the invention copies the essential pattern-matching functionality into a lighter regex format that achieves the same detection purpose without the complexity overhead.
Solution Approach 2:
The patent employs regular expressions as disposable, lightweight signature representations that can be easily created, updated, and discarded. Unlike traditional signatures that require complex engine updates, regex patterns are simple text-based objects that can be rapidly deployed and modified without maintaining complex data structures.
2Measurement precision
If traditional signature schemas are used to express vulnerability states, then detection accuracy is improved, but ease of operation deteriorates due to complex coding requirements
Solution Approach 1:
The patent copies the pattern-matching essence of complex vulnerability detection into regular expressions, which are naturally expressive for text-based patterns. This allows security analysts to write detection rules using familiar regex syntax rather than learning complex schema-based languages, improving ease of operation while maintaining detection accuracy.
3Reliability
If the engine includes logic for various protocols and signature processing, then detection capability is improved, but ease of repair deteriorates due to frequent updates required
Solution Approach 1:
The patent extracts the protocol-specific and signature-processing logic from the engine core and places it into external regular expression patterns. This separation allows the engine to remain simple and stable while detection capabilities are updated by simply replacing regex patterns, dramatically improving ease of repair and reducing maintenance burden.
Solution Approach 2:
The patent copies detection logic into external regex signature files rather than embedding it in the engine. This allows rapid updates by simply replacing signature files without recompiling or reconfiguring the engine, making maintenance trivial while preserving comprehensive detection capability.
Data Source
AI summary
Described is a technology by which a signature used by network traffic intrusion prevention/detection systems includes logic that helps a prevention/detection engine detect that signature. A signature to detect is compiled into executable logic that is executed to communicate with an engine that evaluates network traffic. The signature logic provides an expression set (such as group of regular expressions) for the engine to match against a token corresponding to the network traffic. When matched, the engine notifies the logic and receives a further expression set to match, or a communication indicative that that the signature was detected. The signature thus directs the analysis, facilitating a lightweight, generic engine. Safety of the signature logic is described as being accomplished through layers, including by publisher signing, and by compilation and execution (e.g., interpretation) in safe environments.