Host-Linked Parser Selection for Network Security Message Parsing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in accurately and timely detecting intrusions due to high false alarm rates and the difficulty in distinguishing between normal system usage and true intrusions, especially when dealing with new and unforeseen vulnerabilities.
Innovation Solution
A network security system that efficiently processes messages by associating host identifiers with parsers, attempting parsing with known parsers, and adding parsers for discovered device types to improve message parsing and reduce false alarms through a multi-tier architecture with agents, managers, and consoles, enabling real-time event capture and filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If behavior-based intrusion detection is used to detect new and unforeseen vulnerabilities, then detection capability is improved, but false alarm rate increases
Solution Approach 1:
The system segments the intrusion detection approach into two distinct modules: a knowledge-based module for accurate pattern matching against known threats, and a behavior-based module for detecting novel anomalies. This segmentation allows each module to operate optimally without the other's drawbacks, reducing false alarms while maintaining detection capability for new vulnerabilities.
Solution Approach 2:
The system introduces an intermediary component that acts as a bridge between knowledge-based and behavior-based detection. This intermediary validates behavior-based detections against multiple criteria and cross-references them with knowledge-based patterns, thereby reducing false alarms while preserving the ability to detect new threats.
2Reliability
If knowledge-based intrusion detection is used to achieve low false alarm rates, then reliability is improved, but ability to detect new vulnerabilities deteriorates
Solution Approach 1:
The system merges knowledge-based detection (for reliability) and behavior-based detection (for adaptability) into a unified intrusion detection framework. The knowledge-based component ensures low false alarm rates through proven patterns, while the behavior-based component detects new vulnerabilities by identifying deviations from normal behavior, achieving both reliability and adaptability simultaneously.
Solution Approach 2:
The intrusion detection system is designed with multi-functionality, serving both as a knowledge-based detector for known threats and as a behavior-based detector for novel threats. This universal approach allows the system to handle both established attack patterns and emerging threats within a single framework, eliminating the need to choose between reliability and adaptability.
3Measurement precision
If comprehensive message parsing is performed to improve intrusion detection accuracy, then detection precision is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and categorizing messages before detailed parsing. Messages are initially screened using fast filtering mechanisms that identify obvious patterns and discard non-suspicious messages, reserving comprehensive parsing only for messages that warrant closer inspection. This preliminary action reduces overall processing time while maintaining detection precision for relevant messages.
Solution Approach 2:
The system applies partial parsing action by performing comprehensive analysis only on messages that exhibit suspicious characteristics, rather than applying full parsing to all messages. This selective approach uses excessive action (full parsing) only where necessary, achieving high detection precision for critical messages while minimizing processing time for the overall message stream.
Data Source
AI summary
Device discovery can be made efficient using certain embodiments of the present invention. In one embodiment, the present invention includes accessing a message in a message log, wherein the message log associates a host identifier with the message, the host identifier being an identifier of a host that sent the message to the message log. Then a list of parsers associated with the host identifier associated with the message can be accessed and parsing the message using parsers from the list of parsers associated with the host identifier can be attempted. If the parsing is unsuccessful, a device type of an originator of the message can be discovered, and a parser associated with the discovered device type can be added to the list of parsers associated with the host identifier.