Fragment Reassembly Policy Selection for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems (IDS) are ineffective in accurately processing network traffic due to differences in fragment reassembly methods between various operating systems, allowing attackers to evade detection by exploiting these differences.
Innovation Solution
Implementing a method to analyze fragment trains by identifying and applying specific fragment reassembly policies corresponding to the target system, which reassembles fragments in the same manner as the target system, handling non-overlapped, partially overlapped, and completely overlapped fragments, and providing data in the correct order based on these policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If an IDS utilizes a single reassembly method, then the device complexity is reduced, but the measurement precision of network traffic analysis deteriorates because the IDS cannot accurately detect attacks that exploit differences in fragment reassembly methods
Solution Approach 1:
The patent segments the fragment reassembly process by implementing multiple reassembly methods (RFC 1191, RFC 8896, and custom methods) that correspond to different operating systems. Each reassembly method is applied to specific target systems based on identification, allowing the IDS to match the target system's reassembly behavior without requiring a single complex unified approach.
Solution Approach 2:
The IDS is designed with multi-functionality by incorporating multiple fragment reassembly methods within a single system. The fragment reassembly engine can select and apply appropriate reassembly methods based on the identified target system type, enabling the IDS to handle diverse operating systems (Windows, Linux, BSD, Cisco IOS, etc.) and detect attacks that exploit reassembly differences across these platforms.
2Speed
If the IDS processes fragments using a single reassembly method, then the processing speed is improved, but the reliability of intrusion detection deteriorates due to false negatives from mismatched reassembly behavior
Solution Approach 1:
The patent implements preliminary action by pre-identifying the target system type and selecting the appropriate fragment reassembly method before actual fragment reassembly occurs. The system maintains a database of target system characteristics and pre-configures multiple reassembly methods, enabling rapid selection and application of the correct method without requiring complex real-time analysis during fragment processing.
3Adaptability or versatility
If the IDS implements multiple fragment reassembly methods corresponding to different operating systems, then the adaptability to detect attacks across different systems is improved, but the device complexity increases
Solution Approach 1:
The patent implements dynamics by making the fragment reassembly method selection dynamic and adaptive rather than static. The IDS dynamically identifies the target system type and automatically selects the appropriate reassembly method from its repertoire. This dynamic adaptation allows the system to handle diverse operating systems and attack vectors without requiring manual configuration or increasing permanent structural complexity.
Data Source
AI summary
Fragment trains in a communication network are analyzed. A fragment train includes fragments in the same fragment train and associated with the same target system. One or more fragment reassembly policies are identified out of several fragment reassembly policies, where the fragment reassembly policy corresponds to a target system associated with fragments in a fragment train. The data in the fragments in the fragment train are provided in an order indicated by the fragment reassembly policy. The fragment reassembly policy can include determining the order responsive to an offset and a more fragments indication in the fragments, and/or indicating an order specific to overlapped fragments such as comprehensively overlapped fragments.