Filtering Proxy for Application Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems, including antivirus software and intrusion prevention systems, are inadequate in detecting and responding to zero-day attacks and encrypted network traffic, often resulting in high false positive rates and inability to mount a targeted response due to reliance on signature-based and anomaly-based approaches.
Innovation Solution
A hybrid system that combines signature-based and anomaly-based filters with a supervision framework to grade inputs, allowing for emulation of applications to detect attacks and update filters, incorporating Instruction Set Randomization and Selective Transactional Emulation to negate code injection attacks and generate precise signatures for zero-day attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based filters are used to detect attacks, then detection accuracy for known threats is improved, but the system cannot detect zero-day attacks
Solution Approach 1:
The patent combines signature-based filters and anomaly-based filters into a hybrid system. The signature-based filter component provides accurate detection of known threats through pattern matching, while the anomaly-based filter component detects deviations from normal behavior to identify zero-day attacks. These two filter types work together in parallel to overcome the limitations of each individual approach.
Solution Approach 2:
The supervision framework serves multiple functions: it monitors application behavior, detects anomalies, generates new signatures for zero-day attacks, and updates both signature-based and anomaly-based filters. This multi-functional component enables the system to adapt to new threats while maintaining detection accuracy for known threats.
2Adaptability or versatility
If anomaly-based classifiers are used to recognize new behavior, then detection of zero-day attacks is improved, but false positive rate increases
Solution Approach 1:
The supervision framework acts as an intermediary between the anomaly-based filter and the application. It analyzes anomalous behavior detected by the anomaly-based filter, determines whether the behavior represents a genuine threat or normal variation, and only generates alerts or updates signatures when confirmed threats are detected. This intermediary layer reduces false positives while maintaining detection capability.
Solution Approach 2:
The system implements feedback mechanisms where the supervision framework continuously monitors application behavior, learns from confirmed attacks, and updates both anomaly detection models and signature databases. This feedback loop allows the system to refine its anomaly detection thresholds over time, reducing false positives while maintaining sensitivity to new threats.
3Measurement precision
If intrusion detection systems passively classify information, then detection capability is improved, but response capability is lost
Solution Approach 1:
The supervision framework provides self-service capabilities by automatically generating new signatures for detected zero-day attacks and updating both signature-based and anomaly-based filters without requiring manual intervention. The system self-updates its detection mechanisms based on analyzed attack patterns, maintaining both detection precision and operational responsiveness.
Solution Approach 2:
The system performs preliminary actions by proactively generating and deploying new signatures and filter updates immediately after detecting and analyzing an attack. This preliminary response mechanism ensures that the system is prepared to block subsequent attacks of the same type before they can cause damage, combining detection precision with rapid response capability.
4Reliability
If firewalls use string matching for signature-based prevention, then protection against known threats is improved, but specialized hardware is required and encrypted traffic cannot be inspected
Solution Approach 1:
The patent replaces traditional mechanical string-matching firewalls with a software-based hybrid filtering system that uses both signature-based pattern matching and anomaly-based behavioral analysis. This substitution eliminates the need for specialized hardware while maintaining protection effectiveness, and the software architecture enables inspection of encrypted traffic through protocol analysis and anomaly detection.
Data Source
AI summary
In accordance with some embodiments of the present invention, systems and methods that protect an application from attacks are provided. In some embodiments of the present invention, input from an input source, such as traffic from a communication network, can be routed through a filtering proxy that includes one or more filters, classifiers, and/or detectors. In response to the input passing through the filtering proxy to the application, a supervision framework monitors the input for attacks (e.g., code injection attacks). The supervision framework can provide feedback to tune the components of the filtering proxy.