Intrusion Detection System Dynamic Application Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems (IDS) face difficulties in accurately identifying software applications and communication protocols due to the use of dynamic or randomized port assignments by malicious actors, leading to false positives and false negatives in network attack detection.
Innovation Solution
An IDS analyzes both client-to-server and server-to-client packet flows to make an initial assessment of the application and protocol, and upon receiving a response, it dynamically reclassifies and applies appropriate patterns to improve the accuracy of attack detection, using methods such as hierarchically ordered lists, static mappings, and detailed analysis of TCP data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional IDS uses static port assignment to identify applications, then the system is simple to operate, but it cannot accurately detect attacks when hackers use dynamic or randomized port assignments
Solution Approach 1:
The patent implements dynamic application identification by analyzing packet flow characteristics in real-time rather than relying on static port assignments. The system adapts its identification methods based on the observed traffic patterns, switching between different analysis techniques as needed to accurately identify applications even when using dynamic ports.
Solution Approach 2:
The patent segments the application identification process into multiple independent analysis methods: initial assessment based on port assignment, detailed analysis of packet flow characteristics, and confirmation through response packet analysis. Each segment handles specific aspects of identification, allowing the system to be both comprehensive and manageable.
2Measurement precision
If IDS performs detailed analysis of packet flows to improve identification accuracy, then measurement precision improves, but the processing time and system complexity increase
Solution Approach 1:
The patent performs preliminary assessment of packet flows using quick initial checks based on port assignments and basic characteristics before committing to more time-consuming detailed analysis. This preliminary action filters out cases that don't require extensive analysis, reducing overall processing time while maintaining accuracy for complex cases.
Solution Approach 2:
The system uses feedback from response packets to confirm or correct initial application identifications. By analyzing the server's response to client requests, the system can verify its identification accuracy without requiring overly complex analysis of every single packet, thus balancing precision with processing efficiency.
3Reliability
If IDS uses multiple patterns to improve attack detection probability, then detection reliability improves, but false positives and false negatives increase due to dynamic port assignments
Solution Approach 1:
The patent changes the parameters used for pattern matching from static port-based identification to dynamic characteristics-based identification. By analyzing packet flow characteristics, data sizes, timing patterns, and protocol behavior, the system adapts its detection parameters to match the actual application behavior regardless of port assignment, reducing false positives while maintaining high detection reliability.
Data Source
AI summary
An intrusion detection system (“IDS”) device is described that includes a flow analysis module to receive a first packet flow from a client and to receive a second packet flow from a server. The IDS includes a forwarding component to send the first packet flow to the server and the second packet flow to the client and a stateful inspection engine to apply one or more sets of patterns to the first packet flow to determine whether the first packet flow represents a network attack. The IDS also includes an application identification module to perform an initial identification of a type of software application and communication protocol associated with the first packet flow and to reevaluate the identification of the type of software application and protocol according to the second packet flow. The IDS may help eliminate false positive and false negative attack identifications.