Firewall Detecting Persistent Low Volume Attacks via Token Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional firewalls are ineffective in detecting and combating persistent low volume attacks, which mimic valid user traffic patterns and evade detection by changing signatures and rates, making it difficult to differentiate from legitimate traffic.
Innovation Solution
A persistent low volume attack (PLVA) firewall that transforms network data into canonical representations using tokens and feature vectors, allowing for stateless identification and detection of recurring patterns, even when attack signatures change, and performs protective actions against identified threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewalls use rule-based detection and semi-stateful tracking, then they can detect volumetric attacks, but they fail to detect persistent low volume attacks that mimic valid user traffic
Solution Approach 1:
The system performs preliminary actions by storing canonical representations of legitimate traffic patterns before the attack occurs. When traffic is analyzed, it compares against these pre-stored patterns to detect deviations, enabling early detection of persistent low volume attacks before they can cause significant damage.
Solution Approach 2:
The system creates simplified copies of traffic patterns in the form of canonical representations using tokens and feature vectors. These copies capture the essential characteristics of legitimate traffic without storing the actual traffic data, enabling efficient comparison and detection of anomalies while reducing memory consumption.
2Reliability
If firewalls track actual network traffic contents, then they can detect malicious patterns, but they consume excessive memory and processor resources
Solution Approach 1:
The system extracts only the essential features from network traffic by converting them into tokens and feature vectors. This extraction process removes unnecessary data while preserving the critical characteristics needed for attack detection, significantly reducing memory and processor requirements while maintaining detection accuracy.
Solution Approach 2:
The system changes the parameters of traffic representation by transforming actual traffic data into canonical forms with fixed-length tokens and normalized feature vectors. This parameter transformation enables efficient storage and comparison operations while preserving the ability to detect subtle attack patterns.
3Measurement precision
If firewalls use one-to-one matching against defined rules, then they can detect known attacks, but they cannot detect persistent low volume attacks with changing signatures
Solution Approach 1:
The system introduces dynamics by using probabilistic matching and similarity-based comparison instead of static one-to-one rule matching. The canonical representations allow the system to adapt to varying attack patterns while maintaining detection precision, as it can identify similarities even when exact matches are not present.
Solution Approach 2:
The system achieves universality by creating a unified canonical representation framework that can handle multiple types of attacks with different signatures. The token-based approach and feature vector comparison enable the same detection mechanism to work across diverse attack scenarios, from volumetric attacks to persistent low volume attacks with evolving patterns.
Data Source
AI summary
A network firewall detects and protects against persistent low volume attacks based on a sequence of network data having a pattern that matches by some threshold or percentage a sequence of network data from an earlier iteration of the same persistent low volume attack. The attack patterns are derived from tokenizing one or more elements from a captured sequence of network data that is representative of an attack iteration. Counts for different resulting tokens may be stored in a feature vector that represents the attack pattern. If subsequent sequences of network data have a sufficient number of similar token, a pattern match can be identified and the firewall can take protective action including blacklisting the sending clients, blocking the traffic, redirecting the traffic, sending a problem to verify the sender is an actual user, or other actions.