Firewall Packet Filtering via Offline Symptom Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewalls employ a reactive approach to detect and filter malicious packets, leading to reduced effectiveness in denial-of-service attack detection, degraded throughput, and false alarms due to resource constraints and incomplete packet analysis.
Innovation Solution
A method that filters packets based on pre-defined rules, with a separate offline process creating these rules by analyzing a sample subset of packets for symptoms such as ping floods, broadcast storms, and invalid source addresses, improving firewall throughput by decoupling detection from filtering and executing at a lower priority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive packet detection and filtering is performed in real-time, then network security is maintained, but firewall throughput performance degrades and false alarms increase
Solution Approach 1:
The system performs preliminary offline analysis of packet samples to detect attack patterns and generate detection rules before real-time filtering. The offline analyzer processes historical packet data, identifies symptoms of attacks (e.g., ping floods, broadcast storms, invalid source addresses), and creates optimized detection rules that are then applied in real-time by the filter, eliminating the need for complex real-time analysis
Solution Approach 2:
The firewall system is divided into separate functional components: an offline analyzer that processes packet samples and generates rules, and an online filter that applies these rules in real-time. This segmentation allows the computationally intensive analysis to be performed offline, while real-time operation focuses on efficient rule matching, thereby maintaining both security and throughput performance
2Measurement precision
If complete packet analysis is performed to detect all attack symptoms, then detection accuracy improves, but resource consumption increases and processing speed decreases
Solution Approach 1:
The system performs partial analysis by examining only a sample subset of packets offline to identify attack patterns, rather than analyzing every packet completely in real-time. The offline analyzer processes a representative sample to detect symptoms and generate rules, while the online filter applies these pre-computed rules to all packets, achieving high detection accuracy without the resource cost of complete real-time analysis
Solution Approach 2:
Complete packet analysis is performed in advance during offline processing to build comprehensive detection rules. The offline analyzer thoroughly examines packet characteristics, identifies attack symptoms, and creates optimized rules that capture all necessary detection logic. This preliminary complete analysis enables faster, simpler rule-based filtering in real-time
3Loss of time
If real-time detection of attack symptoms is performed, then response time to attacks is reduced, but system resources are overwhelmed and throughput decreases
Solution Approach 1:
Attack pattern detection and rule generation are performed in advance during offline analysis of packet samples. The system identifies attack symptoms and creates detection rules before attacks occur, so that during real-time operation, the filter can immediately apply these pre-computed rules without performing complex analysis, achieving fast response while maintaining high throughput
Solution Approach 2:
The computationally intensive task of attack detection is extracted from the real-time filtering path and performed offline on packet samples. The offline analyzer extracts attack patterns and generates rules, which are then stored and applied in real-time. This extraction removes the burden of complex detection from the real-time processing path, maintaining both fast response and high throughput
Data Source
AI summary
A method, apparatus, system, and signal-bearing medium that, in an embodiment, filter packets received from a network based on rules. The filtering discards a subset of the packets based on the rules and keeps a remaining subset of the packets. The remaining subset is copied to a destination. The rules are created offline in a lower priority process from the filtering and copying by detecting whether symptoms exist in a sample of the remaining subset. In an embodiment, the order that the symptoms are detected is changed based on the frequency of the existence of the symptoms in the sample. In various embodiments, the symptoms may include receiving a threshold number of ping packets within a time period, receiving a threshold number of broadcast packets within a time period, receiving a packet with an invalid source address, receiving a packet with an invalid header flag, and receiving a threshold number of the packets within a time period that contain a sequence flag. In this way, firewall throughput performance is increased.