Intelligent Firewall Using Command Log Analysis for Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current firewall technologies lack an effective mechanism to predict and prevent abnormal data access patterns, which can lead to malicious attacks, as they rely on static rules rather than intelligent analysis of command logs.

Innovation Solution

A method and system that separates the controlling layer from the data layer, analyzing command logs to establish predictive rules, performing anomaly detection, and generating policy data to determine processing actions for data access commands, thereby implementing an intelligent firewall function.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If static rules are used for firewall control, then device complexity is reduced, but the ability to detect and prevent abnormal access patterns deteriorates

Engineering Contradiction:

Improvefirewall rule structureVSAvoidabnormal access pattern detection

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The system separates the firewall into two independent layers: a control layer that performs intelligent analysis of command logs to generate predictive rules, and a data layer that executes access control decisions. This segmentation allows the data layer to remain simple while the control layer provides advanced detection capabilities through log analysis and anomaly detection algorithms.

Inventive Principle:

Principle #1Segmentation

2Reliability

If intelligent log analysis is implemented, then abnormal access detection capability is improved, but processing time increases

Engineering Contradiction:

Improvemalicious attack preventionVSAvoiddata access processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary analysis of command logs to establish predictive rules and baseline behaviors before actual data access occurs. By pre-processing log data and generating access policies in advance, the system prepares detection criteria beforehand, enabling rapid real-time decisions without performing complex analysis during the actual data access operation.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If dynamic policy generation is used, then adaptability to different access patterns is improved, but device complexity increases

Engineering Contradiction:

Improveaccess pattern adaptationVSAvoidfirewall system structure

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The control layer acts as an intermediary between the data layer and the policy enforcement mechanism. It receives command logs, performs intelligent analysis to detect abnormal patterns, generates adaptive access policies, and transmits them to the data layer. This intermediary approach enables dynamic policy generation without requiring the data layer to become complex, as the control layer handles all analytical and decision-making functions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9811278B2Method, system and apparatus for predicting abnormality

Publication Date: 2017.11.07 WISTRON CORP

AI summary

A method, a system and an apparatus for predicting abnormalities are provided. A controller analyzes a plurality of command logs to obtain a predictive rule for accessing a storage device. The controller performs an anomaly detection for the command logs based on the predictive rule so as to obtain at least one command cluster. The controller establishes policy data corresponding to the predictive rule based on the command logs included in each command cluster, and sends the policy data to a data transmission interface coupled to the storage device. The data transmission interface obtains a processing action for a received data access command according to the policy data.